bruno+docs: status asserts on generated mirrors, OpenAPI spec, safe negative scenarios

Three follow-ups from the smoke run, all additive:

1. Status asserts: bruno_gen.go parses each doc's documented success
   status (## Response (2NN), 'Success is **201**', '**204 No Content**')
   and emits a runtime tests script (expect(res.status).to.eql(N)) on
   148 of 191 mirrors. GETs default to 200 (uniform across this API);
   mutating verbs stay assert-less unless documented — no guessed
   asserts. Verified live: asserts execute and fail loudly (deliberate
   999 probe), pass on real responses.

2. OpenAPI: the same -update run now also writes
   docs/developer/openapi.yaml (141 paths, tags from docs areas,
   security schemes per auth label, request examples literal, no
   invented schemas — the docs site remains the shape reference).
   Verify mode fails when the file is missing.

3. Scenarios: 7 safe negative scenarios rebuilt (auth registration
   matrix 409/403/400, invalid-uuid 400, unknown 404 x2, invalid range
   400) — all no-mutation, repeatable, run via bru: 7/7 tests pass.
   These replace a fraction of the deleted broken suite; mutations-
   heavy scenarios stay out until a design for setup chains exists.

created_at RFC3339 deliberately NOT done — it is the one item that
would break things (Android parses current formats; plan reserves it
as a compat decision).bru run of mutating mirrors also proven to touch
live data (a 'To Read' collection was created and deleted in testing);
only id-less GET mirrors and negative scenarios are safe for blanket
runs.

make test green; generation idempotent (byte-identical re-runs);
no stray smoke rows in users.

bruno/media-items/scenarios/get-media-item-invalid-uuid-400.yml

@@ -0,0 +1,30 @@
+info:
+  name: Get Media Item - Invalid UUID (400)
+  type: http
+  seq: 1
+
+http:
+  method: GET
+  url: '{{base_url}}/api/media-items/not-a-uuid'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 400", function() {
+          expect(res.status).to.eql(400);
+        });
+
+docs:
+  content: |-
+    # Get Media Item - Invalid UUID (400)
+
+    Malformed media item ids must be rejected with 400, never passed to
+    the database layer. Repeats safely.
+  type: text/markdown

bruno/media-items/scenarios/get-media-item-unknown-404.yml

@@ -0,0 +1,29 @@
+info:
+  name: Get Media Item - Unknown (404)
+  type: http
+  seq: 2
+
+http:
+  method: GET
+  url: '{{base_url}}/api/media-items/00000000-0000-0000-0000-000000000000'
+  auth: inherit
+settings:
+  encodeUrl: true
+  timeout: 0
+  followRedirects: true
+  maxRedirects: 5
+
+runtime:
+  scripts:
+    - type: tests
+      code: |-
+        test("status is 404", function() {
+          expect(res.status).to.eql(404);
+        });
+
+docs:
+  content: |-
+    # Get Media Item - Unknown (404)
+
+    A well-formed but nonexistent media item id must 404. Repeats safely.
+  type: text/markdown