Document the backend HTTP API in the hub

[Glittersup]

Problem. ARCHITECTURE.md covers the read path conceptually, but endpoints, query parameters, response shape, and error codes live only in the backend README and in code. A third-party client author has to read the source.

Acceptance criteria

• The hub documents every endpoint with parameters and response shape.
• It stays in sync with the backend's generated OpenAPI spec.