[codex] harden pre-release public sharing and API contracts

[RavelloH]

Summary

• Fix release workflow OpenAPI contract check to call the current TypeScript script through tsx.
• Align API v1 site create/update OpenAPI docs with the implemented top-level public sharing fields.
• Align batch schemas with the current /api/v1/batch request/response shape.
• Add regression coverage for public sharing routes, cache/auth ordering, public client requests, public query allowlist, and API key/batch authorization boundaries.

Validation

• npm ci
• npx vitest run src/schemas/__tests__/analytics.test.ts src/app/api/__tests__/edge-query-routes.test.ts src/lib/edge/__tests__/query-entry.test.ts src/lib/edge/__tests__/query-router.test.ts src/lib/edge/__tests__/dashboard-cache.test.ts src/lib/dashboard/__tests__/client-request.test.ts src/lib/edge/__tests__/query-core.test.ts src/lib/edge/__tests__/api-v1.test.ts src/lib/edge/__tests__/api-v1-docs.test.ts
• npm run check
• npm run check:openapi

Notes

• npm run cf:deploy:dry-run is blocked by deployment configuration: wrangler.toml has database_id = "YOUR_D1_ID" for the default remote D1 binding, and Wrangler rejects it as an invalid UUID. A retry with a temporary process-only MAIN_SECRET passed the secret check and stopped at that D1 id validation.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	insightflare	d95b8a3	Jun 28 2026, 05:03 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	insightflare-demo	d95b8a3	Jun 28 2026, 05:06 AM

[RavelloH]

Closing this draft PR; it will be replaced with a clean branch and commit metadata.