fix(openapi): harden body validation, determinism, and router wiring

[Copilot]

Six issues from code review on the OpenAPI module: unbounded body reads (DoS), silent no-op for non-object body schemas, misleading /openapi.yaml endpoint for JSON sources, nondeterministic content-type error messages, schema/factory base_path default mismatch, and incomplete server→router resolution in wiring.

Changes

module/openapi.go

• Max body size: Added MaxBodyBytes int64 to OpenAPIConfig (default 1 MiB). validate() now wraps r.Body with http.MaxBytesReader and returns a descriptive 400 on overflow instead of consuming arbitrary memory.
• Non-object body validation: Replaced validateJSONBody() with validateJSONValue() at the call site so primitive/array root schemas are validated rather than silently ignored.
• /openapi.yaml endpoint: Only registered when the source spec is YAML. JSON source specs already have /openapi.json; serving JSON bytes at /openapi.yaml was misleading.
• supportedContentTypes() determinism: Added sort.Strings() before strings.Join() for stable error messages.

plugins/openapi/plugin.go

• DefaultConfig alignment: Removed "base_path": "/api/v1" from the schema DefaultConfig; the factory leaves BasePath empty, so the two were inconsistent.
• Server→router wiring: wireOpenAPIRoutes now builds a serverToRouter map from http.router → dependsOn entries (matching the wireStaticFileServers pattern), so an openapi module that dependsOn an http.server correctly resolves the associated router.

module/openapi_test.go

• TestOpenAPIModule_JSONSourceNoYAMLEndpoint: asserts /openapi.yaml absent for JSON-source specs
• TestOpenAPIModule_MaxBodySize: asserts 400 + correct error when body exceeds configured limit

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.