feat: add SAT OpenAPI 3.1 spec

[dmchaledev]

Summary

• Adds the missing sat/openapi.yaml — listed in the README contents table and referenced by the existing CI validation workflow, but not yet present in the repo
• Covers the full SAT product surface: Users, Groups, Modules, Campaigns, Enrollments, and Reports (18 endpoints total)
• Follows identical conventions to asm/openapi.yaml: Bearer auth, pagination envelope, shared Error schema, prefix_id16 identifier pattern, and Spectral-compatible OpenAPI 3.1.0

What's included

Tag	Endpoints
Users	GET/POST /users, GET/PATCH/DELETE /users/{id}
Groups	GET/POST /groups, GET/PATCH/DELETE /groups/{id}
Modules	GET /modules, GET /modules/{id} (read-only catalog)
Campaigns	GET/POST /campaigns, GET /campaigns/{id}, POST …/launch, POST …/cancel
Enrollments	GET/POST /enrollments, GET /enrollments/{id}
Reports	GET /reports/completion, GET /reports/phishing

Why this matters

Without this file the CI workflow silently skips SAT validation (the step is conditional on hashFiles('sat/openapi.yaml') != ''), and the README's contents table has a broken entry. This PR closes both gaps and gives integrators the reference they need to build against the SAT API.

Test plan

• CI Validate OpenAPI Specs workflow passes for sat/openapi.yaml
• Spot-check schemas in a Swagger/Redoc viewer for correctness
• Verify POST /users request body matches the Quick Start example in README (email + group_id)

https://claude.ai/code/session_017zrqLEFs9iNoeaLEmFSRsc

---

Generated by Claude Code