feat: freeze v1 transport contracts (#4)

Closes #4

docs/architecture/README.md

@@ -8,6 +8,7 @@ decision requires a superseding ADR and corresponding contract/test updates.
 - [ADR 0003: state, privacy, availability, and safety budgets](0003-state-privacy-availability-and-budgets.md)
 - [Threat model](../security/threat-model.md)
 - [Security promise and test matrix](../security/control-matrix.md)
+- [Versioned HTTP and UDP contracts](../contracts/README.md)
 
 These decisions intentionally leave gameplay authority, player identity,
 simulation, persistence, social features, skill matchmaking, and gameplay

docs/architecture/project-boundaries.md

@@ -11,11 +11,13 @@ FinalFactory.Rendezvous.Server     FinalFactory.Rendezvous.TestClient
 
 - `Contracts` targets `netstandard2.1` and contains only versioned,
   transport-neutral IDs and wire contracts. It cannot reference Server,
-  LiteNetLib, or Godot.
+  LiteNetLib, or Godot. Its only package is `System.Text.Json`, used for the
+  canonical cross-runtime JSON contract.
 - `Client` targets `netstandard2.1`, references Contracts and the pinned
   LiteNetLib package, and contains no Godot or Server dependency.
-- `Server` targets .NET 10 LTS, references Contracts and LiteNetLib, and owns
-  HTTP hosting, UDP mediation, application policy, and ephemeral state.
+- `Server` targets .NET 10 LTS, references Contracts, LiteNetLib, and the
+  first-party ASP.NET Core OpenAPI generator, and owns HTTP hosting, UDP
+  mediation, application policy, and ephemeral state.
 - `TestClient` targets .NET 8, references only the public Client/Contracts seams
   and LiteNetLib, and must never reach into Server internals.
 - `Tests` target .NET 10 and may reference every project solely to verify public
@@ -32,6 +34,8 @@ engine, transport, or server dependency therefore fails the normal test gate.
   .NET 8-or-later runtime used by current Godot 4 C# projects.
 - TestClient runtime: .NET 8.
 - LiteNetLib: 2.1.4, pinned centrally and restored from the lock files.
+- Microsoft.OpenApi: patched 2.7.5 line, centrally pinned because the version
+  originally pulled by the .NET 10 generator is affected by CVE-2026-49451.
 
 The repository uses central package versions, per-project lock files,
 deterministic compilation, nullable reference types, warnings as errors, current
@@ -43,3 +47,5 @@ Primary compatibility references:
 - [.NET support policy](https://dotnet.microsoft.com/en-us/platform/support/policy)
 - [Godot stable C# prerequisites](https://docs.godotengine.org/en/stable/tutorials/scripting/c_sharp/c_sharp_basics.html)
 - [LiteNetLib 2.1.4 on NuGet](https://www.nuget.org/packages/LiteNetLib/2.1.4)
+- [ASP.NET Core OpenAPI generation](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/openapi/overview?view=aspnetcore-10.0)
+- [Microsoft.OpenApi security advisory](https://github.com/advisories/GHSA-v5pm-xwqc-g5wc)