docs(openapi): document 9 newly-added routes to restore coverage ratchet (v3.8.44)

Documents the routes added this cycle that dropped openapiCoverage 36.9%->36.2%
below the ratchet baseline: 2 public v1 endpoints (/v1/ocr Mistral-OCR-compatible,
/v1/audio/translations Whisper-compatible) with full request/response specs, plus 7
dashboard/CLI-local routes marked x-internal:true (suggested-models, provider-plugin-
manifest, keys/{id}/devices, settings/purge-usage-history, oauth/codex/import-token,
cli-tools crush-settings + codewhale-settings). Coverage 36.2%->37.8% (207/547),
above baseline 36.9. check:openapi-routes/security-tiers/fabricated-docs all pass.

docs/openapi.yaml

@@ -5264,6 +5264,214 @@ paths:
           $ref: "#/components/responses/InternalError"
         "503":
           description: Generator module not available
+  /api/v1/ocr:
+    post:
+      tags:
+        - Images
+      summary: Document OCR
+      description: >-
+        Mistral OCR–compatible document OCR endpoint. Accepts a JSON body
+        referencing a document/image and returns extracted text. Success
+        responses carry the `X-OmniRoute-*` cost-telemetry headers.
+      security:
+        - BearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                model:
+                  type: string
+                document:
+                  type: object
+      responses:
+        "200":
+          description: OCR result with extracted text.
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalError"
+  /api/v1/audio/translations:
+    post:
+      tags:
+        - Audio
+      summary: Translate audio to English
+      description: >-
+        OpenAI Whisper–compatible audio translation (multipart/form-data).
+        Unlike `/api/v1/audio/transcriptions`, output is always English
+        regardless of the source language. Success responses carry the
+        `X-OmniRoute-*` cost-telemetry headers.
+      security:
+        - BearerAuth: []
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required:
+                - file
+              properties:
+                file:
+                  type: string
+                  format: binary
+                model:
+                  type: string
+      responses:
+        "200":
+          description: English translation of the audio.
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "500":
+          $ref: "#/components/responses/InternalError"
+  /api/v1/providers/suggested-models:
+    get:
+      tags:
+        - Providers
+      summary: Suggested media models
+      description: >-
+        Read-only server-side proxy to the public HuggingFace Hub models search
+        API, used by the dashboard to suggest models for a media provider kind
+        without exposing an HF token client-side. Never accepts or returns
+        credentials.
+      parameters:
+        - name: type
+          in: query
+          schema:
+            type: string
+          description: Media kind to search for (e.g. `image`, `audio`, `video`).
+      responses:
+        "200":
+          description: List of suggested HuggingFace Hub models.
+        "500":
+          $ref: "#/components/responses/InternalError"
+  /api/v1/provider-plugin-manifest:
+    get:
+      tags:
+        - Providers
+      summary: Provider plugin manifest
+      description: Returns the manifest describing installed provider plugins.
+      responses:
+        "200":
+          description: Provider plugin manifest.
+        "500":
+          $ref: "#/components/responses/InternalError"
+  /api/keys/{id}/devices:
+    get:
+      tags:
+        - API Keys
+      summary: List devices for an API key
+      description: >-
+        Lists the distinct devices (masked IP + User-Agent fingerprints)
+        tracked for an API key by the in-memory device tracker. IPs are masked
+        before storage; the route never sees the raw client IP.
+      x-internal: true
+      parameters:
+        - name: id
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        "200":
+          description: Distinct devices seen for the API key.
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+        "404":
+          $ref: "#/components/responses/NotFound"
+  /api/settings/purge-usage-history:
+    post:
+      tags:
+        - Settings
+      summary: Purge usage history
+      description: Dashboard-only. Purges stored usage-history records.
+      x-internal: true
+      responses:
+        "200":
+          description: Usage history purged.
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+  /api/oauth/codex/import-token:
+    post:
+      tags:
+        - OAuth
+      summary: Import a Codex connection from a bare access token
+      description: >-
+        Dashboard-only. Creates a Codex (ChatGPT/OpenAI) connection from a raw
+        access token with no refresh token (authType `access_token`).
+      x-internal: true
+      responses:
+        "200":
+          description: Connection imported.
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        "401":
+          $ref: "#/components/responses/Unauthorized"
+  /api/cli-tools/crush-settings:
+    get:
+      tags:
+        - CLI Tools
+      summary: Read Crush CLI OmniRoute config
+      description: Local-only. Reads the OmniRoute provider block in Crush's config.
+      x-internal: true
+      responses:
+        "200":
+          description: Current Crush config state.
+    post:
+      tags:
+        - CLI Tools
+      summary: Write Crush CLI OmniRoute config
+      description: Local-only. Registers OmniRoute as an `openai-compat` provider in Crush's config.
+      x-internal: true
+      responses:
+        "200":
+          description: Crush config updated.
+    delete:
+      tags:
+        - CLI Tools
+      summary: Remove OmniRoute from Crush CLI config
+      description: Local-only. Removes the OmniRoute provider block from Crush's config.
+      x-internal: true
+      responses:
+        "200":
+          description: Crush config entry removed.
+  /api/cli-tools/codewhale-settings:
+    get:
+      tags:
+        - CLI Tools
+      summary: Read CodeWhale CLI OmniRoute config
+      description: >-
+        Local-only. Reads the OmniRoute config block from
+        `~/.codewhale/config.toml` (with `~/.deepseek/config.toml` legacy
+        fallback).
+      x-internal: true
+      responses:
+        "200":
+          description: Current CodeWhale config state.
+    post:
+      tags:
+        - CLI Tools
+      summary: Write CodeWhale CLI OmniRoute config
+      description: Local-only. Writes the OmniRoute config block in CodeWhale TOML format.
+      x-internal: true
+      responses:
+        "200":
+          description: CodeWhale config updated.
+    delete:
+      tags:
+        - CLI Tools
+      summary: Remove OmniRoute from CodeWhale CLI config
+      description: Local-only. Removes the OmniRoute config block from CodeWhale's config.
+      x-internal: true
+      responses:
+        "200":
+          description: CodeWhale config entry removed.
 
 components:
   securitySchemes: