api: make the OpenAPI spec usable as documentation

FastAPI already served /docs, /redoc and /openapi.json, and the ingress already
passed them through — the mechanism was there, the content was not. The schema
alone cannot tell a caller the three things they most need to know, and the
route docstrings explain implementation reasoning to a maintainer rather than
usage to a consumer.

Added to the spec itself, so it travels with the API rather than living in a
README the caller does not have:

  - An app description covering bearer auth, that every write is 202 + poll,
    the instance lifecycle, and the uniform {"code", "message"} error body.
  - Tag descriptions for `instances` and `ops`.
  - Field descriptions and worked examples on CreateInstanceRequest,
    InstanceResponse and ErrorBody, so /docs shows a valid payload instead of
    leaving callers to infer one.

The bearer scheme was already exposed via HTTPBearer, which is what makes the
Authorize button in /docs work; there is now a test asserting it stays, along
with the description, the tags and the request example. Docs that are not
tested rot silently, and this is the artifact other teams integrate against.

README documents the three URLs and how to generate a client from the spec.

services/api/models.py

@@ -24,29 +24,70 @@ class CreateInstanceRequest(BaseModel):
     against the catalog in the handler.
     """
 
-    model_config = ConfigDict(extra="forbid")
+    model_config = ConfigDict(
+        extra="forbid",
+        json_schema_extra={"examples": [{"service_type": "redis", "size": "small", "ttl_days": 7}]},
+    )
 
-    service_type: str = Field(min_length=1)
-    size: str
-    ttl_days: int | None = Field(default=None, ge=1, le=30)
+    service_type: str = Field(
+        min_length=1,
+        description=(
+            "A service type in the catalog, e.g. `elasticsearch`, `redis`, `postgres`. "
+            "Unknown values return 404."
+        ),
+    )
+    size: str = Field(
+        description=(
+            "A size the catalog defines for that service type, e.g. `small`. Unknown values return 422."
+        ),
+    )
+    ttl_days: int | None = Field(
+        default=None,
+        ge=1,
+        le=30,
+        description="Delete the instance automatically after this many days. Omit for no expiry.",
+    )
 
 
 class InstanceResponse(BaseModel):
     """What a tenant gets back. A subset of Instance, on purpose."""
 
-    model_config = ConfigDict(from_attributes=True)
+    model_config = ConfigDict(
+        from_attributes=True,
+        json_schema_extra={
+            "examples": [
+                {
+                    "id": "0f8b7d3e-1c2a-4f5b-9e6d-7a8b9c0d1e2f",
+                    "state": "ready",
+                    "service_type": "redis",
+                    "size": "small",
+                    "endpoint": "http://acme-redis-0f8b7d3e.tenant-acme.svc.cluster.local",
+                    "chart_version": "20.6.2",
+                    "error": None,
+                }
+            ]
+        },
+    )
 
-    id: UUID
-    state: InstanceState
+    id: UUID = Field(description="Poll `GET /v1/instances/{id}` with this to watch the state change.")
+    state: InstanceState = Field(description="Lifecycle state. Only `ready` carries a usable endpoint.")
     service_type: str
     size: str
-    endpoint: str | None
-    chart_version: str
-    error: str | None
+    endpoint: str | None = Field(description="In-cluster DNS name. Null until the instance is `ready`.")
+    chart_version: str = Field(
+        description="The chart version actually deployed, written only after helm succeeds."
+    )
+    error: str | None = Field(description="Why the last attempt failed. Null unless `state` is `failed`.")
 
 
 class ErrorBody(BaseModel):
     """Every non-2xx body. `code` is for machines, `message` is for humans."""
 
-    code: str
-    message: str
+    model_config = ConfigDict(
+        json_schema_extra={
+            "examples": [{"code": "unknown_service_type", "message": "no such service_type: mongodb"}]
+        }
+    )
+
+    code: str = Field(description="Stable machine-readable identifier for the failure.")
+    message: str = Field(description="Human-readable detail. Do not parse this.")