feat: v3.6.4 — Combo Builder v2, Composite Tiers, P2C Credentials, Observability Layer

## New Features
- Combo Builder v2 wizard UI (multi-stage: Basics → Steps → Strategy → Review)
- Combo Step Architecture Schema v2 (ComboModelStep, ComboRefStep, pinned accounts)
- Composite Tiers system for tiered model routing with fallback chains
- Model Capabilities Registry (unified resolver merging specs + registry + synced data)
- Observability module (buildHealthPayload, buildTelemetryPayload, buildSessionsSummary)
- Session & Quota Monitor panels on Health dashboard
- Combo Health per-target analytics via resolveNestedComboTargets()
- Combo Builder Options API (GET /api/combos/builder/options)

## Performance
- Middleware lazy loading (apiAuth, db/settings, modelSyncScheduler)
- E2E auth bypass mode (NEXT_PUBLIC_OMNIROUTE_E2E_MODE)

## Bug Fixes
- P2C credential selection with quota headroom awareness
- Fixed-account combo steps bypass model cooldowns/circuit breakers
- Combo metrics per-target tracking (byTarget with executionKey)
- Call logs schema expansion (7 new columns + composite index)
- Quota monitor lifecycle enrichment (status, snapshots, summary)
- Codex quota fetcher hardening

## Maintenance
- DB migration 021 (combo_call_log_targets)
- Combo CRUD normalization on read
- Playwright config + build script improvements
- OpenAPI spec version sync to 3.6.4

## Tests
- 16 new test suites + 12 existing test updates
- 86 files changed, +8318 -1378 lines

src/app/api/openapi/spec/route.ts

@@ -6,20 +6,21 @@
 import { NextResponse } from "next/server";
 import fs from "fs";
 import path from "path";
+import { fileURLToPath } from "url";
 import yaml from "js-yaml";
 
 let cachedSpec: { data: any; mtime: number } | null = null;
+const ROUTE_DIR = path.dirname(fileURLToPath(import.meta.url));
+const PROJECT_ROOT = path.resolve(ROUTE_DIR, "../../../../../");
+const OPENAPI_SPEC_CANDIDATES = [
+  path.join(PROJECT_ROOT, "docs", "openapi.yaml"),
+  path.join(PROJECT_ROOT, "app", "docs", "openapi.yaml"),
+];
 
 export async function GET() {
   try {
-    // Try multiple locations for the spec file
-    const candidates = [
-      path.join(process.cwd(), "docs", "openapi.yaml"),
-      path.join(process.cwd(), "app", "docs", "openapi.yaml"),
-    ];
-
     let specPath = "";
-    for (const p of candidates) {
+    for (const p of OPENAPI_SPEC_CANDIDATES) {
       if (fs.existsSync(p)) {
         specPath = p;
         break;