feat: dev-only OpenAPI document at /openapi/v1.json

- AddOpenApi/MapOpenApi (anonymous, Development environment only).
- security: mark ProfileCvController.ProcessQueuedRunAsync [NonAction] -
  the controller-level [Route] exposed this background-service hook as a
  routable any-verb endpoint, which also broke OpenAPI generation.

96 endpoint paths documented.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

JobTrackerApi/Program.cs

@@ -112,6 +112,7 @@ builder.Services.AddCors(options =>
 
 // Add controllers
 builder.Services.AddControllers();
+builder.Services.AddOpenApi();
 var dataRoot = (builder.Configuration["Data:Root"] ?? "").Trim();
 if (string.IsNullOrWhiteSpace(dataRoot))
 {
@@ -441,4 +442,10 @@ app.UseAuthentication();
 app.UseAuthorization();
 app.MapControllers();
 
+// API schema for tooling/docs. Dev-only: not exposed in production deployments.
+if (app.Environment.IsDevelopment())
+{
+    app.MapOpenApi().AllowAnonymous();
+}
+
 app.Run();