feat: dev-only OpenAPI document at /openapi/v1.json

- AddOpenApi/MapOpenApi (anonymous, Development environment only).
- security: mark ProfileCvController.ProcessQueuedRunAsync [NonAction] -
  the controller-level [Route] exposed this background-service hook as a
  routable any-verb endpoint, which also broke OpenAPI generation.

96 endpoint paths documented.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

JobTrackerApi/Controllers/ProfileCvController.cs

@@ -883,6 +883,10 @@ public sealed class ProfileCvController : ControllerBase
         return run;
     }
 
+    // Invoked by CvProcessingHostedService (this controller is also registered as a
+    // transient service). NonAction keeps it off the HTTP surface: without it the
+    // controller-level [Route] exposes it as an any-verb endpoint.
+    [NonAction]
     public async Task ProcessQueuedRunAsync(int runId, CancellationToken cancellationToken)
     {
         var run = await _db.CvExtractionRuns.FirstOrDefaultAsync(x => x.Id == runId, cancellationToken);