refactor(api): generate runtime metadata SDK

[Medformatik]

What changed and why

Capabilities and integration metadata had handwritten client DTOs that drifted from the server, and /api/integrations was missing from OpenAPI. Both endpoints now use shared response schemas and an Orval-generated SDK with runtime validation. Every consumer in this family is migrated; legal pages read one live, uncached metadata snapshot. Their dates advance to October 18 in both locales as required by the source-change gate; policy wording is unchanged.

• Preserve complete source/licensing/frontend/catalog/disclosure metadata, revision/ETag and bodyless 304; expose only type/name/category in public health summaries.
• Keep credentials, isolated clients, cancellation through body consumption, deadlines and bounded redacted failures in the existing transport. Remove duplicated DTOs and unused capability plumbing.
• Fix the docs image security gate by adding libx11 to its existing targeted Alpine upgrades (CVE-2026-88806, 1.8.13-r0 → 1.8.14-r0).
• Generate only this fully specified API family and check generated artifacts in the policy gate. Other inventory-only endpoints remain later batches.

Orval was compared with Hey API, openapi-typescript/openapi-fetch, OpenAPI Generator and swagger-typescript-api. Its documented custom-client boundary fits the existing transport. The pinned configuration preserves recursive schemas and selects validated output types using its supported transformer. Its declared, maintained js-yaml 4.3.2 parser is scoped to dev-only generation; other consumers retain the workspace v5 policy.

Rendered legal pages: date/layout verification

Local Next.js pages inspected in the collaborative browser. Rich runtime provider metadata is covered separately by producer-to-SDK tests.

Before	After

Privacy DE after	Terms DE after

Verification

• Full local verification passed: 1,757 test files / 20,280 tests, 186 tests skipped; all 30 type tasks, lint, policy, OpenAPI and SDK freshness passed.
• API production build and clean packed-contracts/CLI consumer qualification passed.
• CI follow-up: reproduced the docs runtime CVE, rebuilt the complete linux/amd64 docs image from tracked files, and scanned it with a fresh Trivy database: zero fixable HIGH/CRITICAL findings. nginx configuration and HTTP smoke checks passed. CI uses Trivy 0.75.0; the local verification used 0.76.0. Original CI passed all application/test/database gates; fresh CI will verify the image correction.
• Actual producer → Fastify JSON → generated SDK tests cover rich contracts, private-field exclusion, conditional responses, malformed replies and recursive type precision. Transport tests cover cancellation, deadlines, header forms and unread-body disposal.
• Independent Codex review approved. No new clone regions; Knip has the same three existing dependency findings.
• No production deployment, database integration suite or native-device run. Browser checks covered both legal pages in English/German; the only intentional visible change is their dates.

Release and upgrade impact

Product impact: breaking

Public integration health metadata no longer exposes operational URLs, headers or configuration keys. Bundled consumers migrate together; custom internal-API consumers must use the current contracts. No database/configuration migration or compatibility layer.

The Changeset covers the new portable output-schema exports and CLI rebuild. A product release-note fragment records the internal API change. No package publication or deployment is performed here.