CI: enforce zero redocly OpenAPI warnings (--max-problems 0)

[nickna]

Summary

Today redocly lint (via tools/openapi → npm run validate:openapi, run in CI's "OpenAPI contract validation and drift check" step) emits 7 warnings but exits 0, so nobody sees them and regressions accumulate silently. Once the known warnings are cleared (#1086, #1087), flip the safety net on so any new OpenAPI warning fails CI.

Change

In tools/openapi/package.json, make the lint fail on any problem:

"lint:openapi": "redocly lint --max-problems 0 --config ../../redocly.yaml ../../Services/ConduitLLM.Admin/openapi-admin.json ../../Services/ConduitLLM.Gateway/openapi-gateway.json",

(Alternatively, promote the specific rules to error in redocly.yaml. --max-problems 0 is broader — it also catches new warning types we haven't explicitly opted into.)

CI already invokes this via npm run validate:openapi in .github/workflows/ci.yml, so no workflow change is needed — the stricter script gates PRs automatically.

Blocked by

• Gateway OpenAPI: remove orphaned Stream schema and drop 501-only /v1/completions from the contract #1086 — clear the 2 Gateway warnings (orphaned Stream, 501-only /v1/completions)
• Admin OpenAPI: silence 5 known-safe no-ambiguous-paths warnings via redocly lint-ignore #1087 — silence the 5 Admin no-ambiguous-paths false positives via lint-ignore

Both must land first, or this turns CI red.

Acceptance criteria

• lint:openapi exits non-zero on any redocly warning/error.
• A PR that introduces a new OpenAPI warning fails the "OpenAPI contract validation and drift check" job.
• Existing lint is clean (0 problems) at merge time.

Notes

• Pure CI/config; no contract or runtime change. Related: fix: broken OpenAPI tool project reference + Functions security-pin drift #1059.