feat(api): standardize REST contracts and auth

docs/api-style.md

@@ -0,0 +1,22 @@
+# TJWater REST API v1
+
+This contract is the public API contract for coordinated TJWater
+Server, Agent, Frontend, and CLI releases.
+
+- Paths use lowercase kebab-case, have no trailing slash, and identify
+  resources rather than handler actions.
+- JSON fields, query parameters, and path parameter names use snake_case.
+- Project-scoped requests use `X-Project-Id`; `network` query parameters
+  are not part of the public contract.
+- `GET` is read-only. Synchronous analysis and simulation requests use
+  `POST` and clients must not retry them automatically.
+- JSON errors use `application/problem+json`.
+- The static OpenAPI file and `contracts/manifest.json` are release
+  artifacts even when production runtime documentation is disabled.
+
+Generate and validate the contract with:
+
+```bash
+conda run -n server python scripts/export_openapi.py
+conda run -n server python scripts/check_openapi.py
+```