Add local Swagger UI and OpenAPI Try it out workbench

[kcskribbl]

Summary

• Add a checked-in OpenAPI 3.0.3 document covering all five existing local API operations and their request/response/error schemas.
• Serve pinned, self-hosted Swagger UI at /docs and /docs/; Try it out targets the same local server and port through the relative / server URL.
• Document the complete synthetic clinician → enroll → append → verified timeline workflow in docs/LOCAL_API.md and link it from the README.

Independent scope

This PR targets main directly (base commit 61a68ab), not the storage PR. It contains no storage provider, cloud adapter, diagram or biometric integration changes. Existing API/business behavior and error handling remain unchanged.

Try locally

npm ci
npm start

Open http://127.0.0.1:3000/docs (or /docs on your configured local port). Execute GET /api/status, then POST /api/clinicians. Copy the entire generated demo credential JSON into the enroll example, choose a new synthetic factor of at least 16 characters, and reuse both factors for append and timeline. No cloud account or external Swagger service is required.

Privacy and browser boundaries

• Synthetic data only; never enter real patient information, biometrics or real credentials. This is research software, not a clinically safe or production-ready system.
• Requests are real: enrollment/append persist encrypted demo records to the existing local store. Demo private keys, factors and decrypted responses remain visible in the page and developer tools; do not share screenshots or HAR exports.
• No CDN, external spec validator, query-string config override or authorization persistence. The request interceptor rejects off-origin URLs; browser connections remain same-origin under CSP.
• Swagger assets are allowlisted, docs writes are rejected, and inline styles are allowed only for documentation HTML. Existing main-UI script/style policy is unchanged. Scarf installation analytics are opted out.

Verification

• npm test -- test/swagger.spec.ts test/web-server.spec.ts: 11 passed.
• npm test: 37 passed across 7 files.
• npm run typecheck: passed.
• npm run build: passed.
• npm audit --omit=dev --audit-level=low: 0 runtime vulnerabilities.
• New tests validate docs/CSP/assets, local OpenAPI references, same-origin guards, the real installed Swagger bundle and its status Try it out, plus the documented live enroll/append/timeline flow and negative API outcomes.
• Independent headless Microsoft Edge smoke test: all five operations render; actual UI GET status returns 200 and POST clinician returns 201; no external page requests, browser storage writes or CSP/runtime errors (excluding the existing missing favicon).
• git diff --check: passed.

Existing limitations

This documents the existing POC API, not full FHIR conformance. Existing generic 500 responses for malformed PEMs, too-short factors and unmapped service errors are documented rather than changed. Reloading is not a guarantee of secure memory erasure. Unrelated existing dev-dependency findings are outside this PR.