Story-1478 EPIC-030 Phase 1 Codegen foundation

Admin now has the generated Kubb client foundation.

This walkthrough is for reviewers checking that the admin OpenAPI snapshot, generated contracts, generated browser client layer, and contract assertion helper are aligned without migrating runtime pages yet.

What Changed

The vendored openapi/admin-api.json snapshot was refreshed from pramaan-functions main before regeneration. The only semantic producer drift in that sync is the retired HealthResponse.correlation_id field from the trace ID refactor.

kubb.config.ts now runs OAS, TypeScript, Zod, generated client, and React Query plugins.
Zod generation now matches app posture: dateType: "string", typed schemas, and no blanket .strict() wrapper.
src/gen/client and src/gen/hooks are generated and committed with the refreshed src/gen output.
src/gen/_assert.ts is hand-maintained beside generated contracts and survives regeneration.

Trust Boundary Check

All admin contract assertion imports now point at @/gen/_assert. The retired src/lib/assert-contract.ts file was deleted, but its behavior was preserved: parse with the generated Zod schema, log api_contract_violation with the existing admin context fields, then throw a contract-violation error.

Observability: no new tracer calls or instrumentation libraries were added. The contract-violation log signal is preserved through @/gen/_assert; tracing remains owned by src/proxy.ts and src/lib/gateway.ts per pramaan-docs ADR-104 and pramaan-docs ADR-065.

Runtime Boundary

The new src/lib/kubb-client.ts is only the compile-time browser adapter that generated client and hook files import. It maps generated /admin/* paths onto the future /api/internal/* namespace and throws on server-side use.

Left for #1479

Actual /api/internal/* BFF route handlers, including the first firms route, are intentionally not created here.

Left for #1480

The TanStack Query provider and invalidation runtime are intentionally not mounted here.

Left for Later Stories

No admin page, list, mutation, or optimistic UX flow was migrated to generated hooks in this foundation Story.

Reviewer Checks

Run pnpm kubb:generate and confirm src/gen/_assert.ts remains present.
Run git diff --exit-code src/gen/ after regeneration to prove CI codegen freshness parity.
Confirm rg '\.strict\(' src/gen/zod returns no matches.
Confirm rg 'assert-contract' src tests docs/agent-rules returns no retired import paths.