refactor: align frontend ownership boundaries

Close audit gaps across API drift, query policy, UI, and tests.

scripts/check-openapi.mjs

@@ -0,0 +1,40 @@
+import { spawnSync } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+const temporaryDirectory = await mkdtemp(
+	join(tmpdir(), "wealth-ledger-openapi-"),
+);
+const generatedPath = join(temporaryDirectory, "schema.d.ts");
+const committedPath = resolve("src/shared/api/generated/schema.d.ts");
+const cliPath = resolve("node_modules/openapi-typescript/bin/cli.js");
+let exitCode = 0;
+
+try {
+	const generated = spawnSync(
+		process.execPath,
+		[cliPath, "src/shared/api/spec/openapi.json", "-o", generatedPath],
+		{ encoding: "utf8" },
+	);
+
+	if (generated.status !== 0) {
+		process.stderr.write(generated.stderr || generated.stdout);
+		exitCode = generated.status ?? 1;
+	} else {
+		const [committed, current] = await Promise.all([
+			readFile(committedPath, "utf8"),
+			readFile(generatedPath, "utf8"),
+		]);
+		if (committed !== current) {
+			console.error(
+				"Generated OpenAPI types are stale. Run `npm run openapi:generate` and commit the result.",
+			);
+			exitCode = 1;
+		}
+	}
+} finally {
+	await rm(temporaryDirectory, { recursive: true, force: true });
+}
+
+process.exitCode = exitCode;