Sync OpenAPI spec: a9599d5

[zeyu2001]

Regenerated openapi.json from the public REST spec that just shipped to prod.

• Source commit: a9599d5

The API reference pages resolve their operations from this spec, so this keeps the published reference in sync with the live API.

---

Note

Low Risk
Documentation-only OpenAPI sync; no runtime code changes, though clients should adopt new finding and repo response fields if they generate from the spec.

Overview
Regenerates openapi.json so the published API reference matches production (commit a9599d5). Most line churn is JSON formatting (multi-line enum/tags/required arrays); the substantive contract updates are below.

Findings now expose required display_id and number on list and detail responses, and document that GET/PATCH /findings/{id} and POST /findings/{id}/comments accept either a UUID or a display id (e.g. HAC-FD-1104).

Repos list entries add required openFindingsCount and lastScanAt on UnifiedRepoDto.

Scans clarify auth_instructions as target-site URLs plus browser login/credential instructions.

^{Reviewed by Cursor Bugbot for commit c431d65. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T11:03:03.462436Z	c431d65	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.