fix: pre-release public sharing and api contracts

[RavelloH]

Summary

• Fix release workflow OpenAPI contract check to call the current TypeScript script through tsx.
• Align API v1 site create/update OpenAPI docs with the implemented top-level public sharing fields.
• Align batch schemas with the current /api/v1/batch request/response shape.
• Add regression coverage for public sharing routes, cache/auth ordering, public client requests, public query allowlist, and API key/batch authorization boundaries.

Validation

• npm ci
• npx vitest run src/schemas/__tests__/analytics.test.ts src/app/api/__tests__/edge-query-routes.test.ts src/lib/edge/__tests__/query-entry.test.ts src/lib/edge/__tests__/query-router.test.ts src/lib/edge/__tests__/dashboard-cache.test.ts src/lib/dashboard/__tests__/client-request.test.ts src/lib/edge/__tests__/query-core.test.ts src/lib/edge/__tests__/api-v1.test.ts src/lib/edge/__tests__/api-v1-docs.test.ts
• npm run check
• npm run check:openapi

Notes

• npm run cf:deploy:dry-run is blocked by deployment configuration: wrangler.toml has database_id = "YOUR_D1_ID" for the default remote D1 binding, and Wrangler rejects it as an invalid UUID. A retry with a temporary process-only MAIN_SECRET passed the secret check and stopped at that D1 id validation.

[RavelloH]

Closing this draft PR; changes will be committed directly to main as requested.