Fix failing CI: OpenAPI lint + 32 pre-existing test failures it was masking

[praizehimm]

main's CI test job has been failing on every push/PR since the OpenAPI lint step started rejecting openapi.yaml, which also silently masked several other pre-existing failures further down the same job (ESLint runs with continue-on-error, but npm test doesn't, so nothing after the lint step ever actually ran).

Lint OpenAPI spec (the step that was actually failing on main)

• openapi.yaml uses exclusiveMinimum: 0 in three places, which is the JSON-Schema-2020-12 numeric form. This spec is OpenAPI 3.0.3, which requires the boolean-modifier form (minimum: 0 + exclusiveMinimum: true). Fixed all three.

Once that step could pass, npm test itself failed 32/670 tests — all pre-existing, just never reached before:

• test/api-docs.test.js — missing helmet import; the test called helmet() without requiring it.
• test/cors.test.js — the test's own inline error handler read err.status and returned a flat string body; the real AppError class sets statusCode, and the real errorHandler returns {error:{code,message}}. Swapped in the actual errorHandler middleware instead of hand-rolling a mismatched one.
• src/errors/AppError.js — WEBHOOK_TARGET_BLOCKED, INVALID_URL, and TIMEOUT were all thrown via new AppError(code, ...) elsewhere in the codebase but were never added to the ERROR_CODES registry, so the constructor's own unknown-code guard threw a plain Error instead of the intended typed one. For the SSRF guard this was especially bad: it meant the guard silently no-op'd (crashed and got swallowed) rather than blocking anything.
• src/services/webhookDispatcher.js + src/routes/webhooks.js — the SSRF guard (ssrfGuard.js) already existed, fully implemented, but was never actually called from the /webhooks/:id/test endpoint. Wired it in, and reduced the response's last_error to a generic unreachable/error_response category instead of echoing raw network error strings (raw detail is still stored on the delivery record and logged server-side for operators).
• src/services/dbHealth.js — read raw process.env.DATABASE_URL (unset in CI) instead of the already-resolved config.databaseUrl (which has proper test/dev defaults), and attempted a live SELECT 1 even though nothing in the app queries the database yet (it was added for api_key_audit_logs, not on any request path). /health now reports configured: true, checked: false, status: 'unused' instead of crashing/misreporting.
• src/db/migrations/20260801000000_add_api_key_audit_logs.js — rewrote using raw SQL to match every other migration in the repo. The original used knex's schema builder (knex.schema.dropTable(...)), which is functionally correct but invisible to migrationSafety's text-based DROP TABLE scan, so this migration's rollback safety was never actually verified by the audit it's supposed to go through.
• test/coingecko.test.js, test/coinmarketcap.test.js — circuitBreaker.getState() gained a last_success_at field at some point; updated the two full-object toEqual assertions to include it.
• test/priceWebSocket.test.js — the test constructed its own new PriceSubscriptionManager() instead of using the module's real exported singleton. The actual WS server registers connections on the singleton, so the test's separate instance never saw them — connectionCount stuck at 0 and notifyPriceUpdates() never reached the real connected socket. Fixed to use the singleton directly.
• test/health.test.js — every one of the 6 per-test cache mocks (main describe + 5 local re-mocks) was missing getCommandQueueLength, which /health now calls. This alone accounted for 14 of the 32 failures and made the file look like it was hanging (each failing request was actually just erroring instantly — the appearance of slowness was --forceExit masking a real crash-then-recover loop; with the fix the file runs in ~7s instead of ~72s).

Verified locally:

• Full npm test suite: 670/670 passing (--runInBand; a couple of tests are flaky under heavy parallel worker contention against a single local Redis, unrelated to this fix)
• npx knex migrate:latest and migrate:rollback --all against a real local Postgres instance
• npx @redocly/cli lint openapi.yaml — 0 errors (11 pre-existing warnings unchanged, not in scope)

Not touched: npm audit --audit-level=high currently reports 2 high-severity transitive vulnerabilities (via stellar-sdk's toml dependency). This is unrelated to the CI failure this PR fixes — audit's advisory database is live and time-varying, and this step was passing in the last recorded CI run. Flagging it here rather than pulling in an unrelated dependency bump.