feat: complete phase 3 -- OpenAPI auto-discovery, SSRF protection, tool generation

- SSRF protection: private IP blocking, DNS rebinding defense, redirect validation
- OpenAPI fetcher with SSRF guard, JSON/YAML auto-detection, 10MB limit
- Structural spec validator (3.0.x/3.1.x)
- Endpoint parser with $ref resolution, auto-generated operation IDs
- Heuristic + LLM endpoint classifier with Protocol interface
- Review API at /api/openapi (import, job status, classification CRUD, approve)
- @tool code generator + Agent YAML generator
- Import orchestrator (fetch -> validate -> parse -> classify pipeline)
- 125 new tests, 322 total passing, 93.23% coverage

backend/pyproject.toml

@@ -19,6 +19,7 @@ dependencies = [
     "pyyaml>=6.0,<7.0",
     "python-dotenv>=1.0,<2.0",
     "httpx>=0.28,<1.0",
+    "openapi-spec-validator>=0.7,<1.0",
 ]
 
 [project.optional-dependencies]
@@ -28,6 +29,7 @@ dev = [
     "pytest-cov>=6.0,<7.0",
     "httpx>=0.28,<1.0",
     "ruff>=0.9,<1.0",
+    "pytest-httpx>=0.35,<1.0",
 ]
 
 [build-system]