Add OpenAPI contract - phase 1 scope

Closes #511 (well, the part about having the contract in the codebase).

Based on the feedback from the discussion, the contract has been scoped down to what we're actually building in phase 1. Agencies and auth are out for now the assumption is that FireForm runs inside an org's local network, so there's no real need for auth at this stage.

What changed from the originally proposed contract:

• Agencies and auth are out scoped to phase 2 as agreed in Proposal to design and follow OpenAPI contract #511
• Health is now a single endpoint instead of two the Ollama model/load detail is folded into /api/v1/health directly
• Cleaned up a few places where agency_id was marked required, which would've broken things once the agencies registry was removed

Contract structure:

contracts/
├── openapi.yaml
├── path/
│   ├── input.yaml
│   ├── extraction.yaml
│   ├── forms.yaml
│   ├── incidents.yaml
│   ├── reporting.yaml
│   ├── templates.yaml
│   ├── jobs.yaml
│   └── system.yaml
└── schemas/
    ├── canonical-incident.yaml
    ├── common.yaml
    ├── enums.yaml
    ├── extraction-record.yaml
    ├── form-record.yaml
    ├── incident-record.yaml
    ├── input-record.yaml
    ├── reporting.yaml
    ├── system.yaml
    └── template.yaml

The contract is split into path definitions and schemas to keep it readable as it grows. openapi.yaml is the root entry point.

Fixes: #534