bruno+docs: status asserts on generated mirrors, OpenAPI spec, safe negative scenarios

Three follow-ups from the smoke run, all additive:

1. Status asserts: bruno_gen.go parses each doc's documented success
   status (## Response (2NN), 'Success is **201**', '**204 No Content**')
   and emits a runtime tests script (expect(res.status).to.eql(N)) on
   148 of 191 mirrors. GETs default to 200 (uniform across this API);
   mutating verbs stay assert-less unless documented — no guessed
   asserts. Verified live: asserts execute and fail loudly (deliberate
   999 probe), pass on real responses.

2. OpenAPI: the same -update run now also writes
   docs/developer/openapi.yaml (141 paths, tags from docs areas,
   security schemes per auth label, request examples literal, no
   invented schemas — the docs site remains the shape reference).
   Verify mode fails when the file is missing.

3. Scenarios: 7 safe negative scenarios rebuilt (auth registration
   matrix 409/403/400, invalid-uuid 400, unknown 404 x2, invalid range
   400) — all no-mutation, repeatable, run via bru: 7/7 tests pass.
   These replace a fraction of the deleted broken suite; mutations-
   heavy scenarios stay out until a design for setup chains exists.

created_at RFC3339 deliberately NOT done — it is the one item that
would break things (Android parses current formats; plan reserves it
as a compat decision).bru run of mutating mirrors also proven to touch
live data (a 'To Read' collection was created and deleted in testing);
only id-less GET mirrors and negative scenarios are safe for blanket
runs.

make test green; generation idempotent (byte-identical re-runs);
no stray smoke rows in users.

internal/docs/drift_test.go

@@ -208,6 +208,9 @@ func TestBrunoMirrorsDocs(t *testing.T) {
 		if err != nil {
 			t.Fatalf("regenerate bruno mirrors: %v", err)
 		}
+		if err := updateOpenAPISpec(docs); err != nil {
+			t.Fatalf("regenerate openapi spec: %v", err)
+		}
 		t.Logf("bruno mirrors: %d written, %d deleted", len(written), len(deleted))
 		for _, rel := range written {
 			t.Logf("  wrote %s", rel)
@@ -215,6 +218,9 @@ func TestBrunoMirrorsDocs(t *testing.T) {
 		for _, rel := range deleted {
 			t.Logf("  deleted %s", rel)
 		}
+		t.Logf("openapi spec written")
+	} else if _, err := os.Stat(filepath.Join(docsRoot, "..", "openapi.yaml")); err != nil {
+		t.Errorf("docs/developer/openapi.yaml missing — regenerate with: go test ./internal/docs -run TestBrunoMirrorsDocs -update")
 	}
 
 	// Collect bruno requests: "METHOD normalized-path" -> relpath.