Public REST API: full CRUD-lite across assets, flags, hours, work orders, tools, projects, yards, repairs, webhooks

Iterations 21-50 built out the public /api/v1/* surface to ~33 routes. Full CRUD-lite on every primary resource (list / detail / create / update / batch where it matters). HMAC-signed webhooks for eight event types. Cross-tenant 404, never 403. /docs/api + /docs/api/recipes + /docs/api/sdk; OpenAPI 3.1 at /openapi.yaml; AsyncAPI 2.6 at /asyncapi.yaml; Postman collection at /postman_collection.json.