fix(openapi): address remaining review comments — validation, content-type, schema, defaults

[Copilot]

Several correctness and UX issues remained unresolved from prior review rounds on the OpenAPI module.

module/openapi.go

• Body restoration: strings.NewReader(string(bodyBytes)) → bytes.NewReader(bodyBytes) — eliminates redundant alloc and prevents corruption of non-UTF-8 payloads
• Invalid JSON → 400: json.Unmarshal errors were silently ignored; malformed bodies now produce a 400 with a descriptive message
• YAML endpoint content-type: /openapi.yaml always returned application/yaml even for JSON source files; now detects source format by inspecting the first byte
• swagger_ui.path normalization: paths without a leading / (e.g. "docs") were concatenated directly with base_path, producing invalid routes like /api/v1docs
• Unknown Content-Type → 400: a Content-Type present in the request but absent from requestBody.content silently bypassed validation; now returns 400 listing the supported types

plugins/openapi/plugin.go

• Factory defaults: OpenAPIConfig zero value left Validation.Request = false; factory now initializes it to true before applying overrides, matching documented behavior
• Wiring hook logging: missing router was silently skipped with a misleading comment; now emits slog.Warn with the module name

schema/module_schema.go

• router not required: removed Required: true — the wiring hook auto-detects the router when omitted
• Dotted schema keys: validation.request, validation.response, swagger_ui.enabled, swagger_ui.path as flat bool/string fields don't map to the nested config structure; replaced with two FieldTypeJSON fields (validation, swagger_ui)

module/openapi_test.go

• Added invalid_JSON sub-test to TestOpenAPIModule_RequestValidation_Body to cover the previously unguarded decode-error path

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.