feat(api): admin auth surface (login/logout/me/users/publish) on tower-sessions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/api/src/openapi.rs

@@ -1,16 +1,29 @@
 use axum::{Json, Router, extract::State, routing::get};
 use utoipa::OpenApi;
 
-use crate::{AppState, health, public};
+use crate::{AppState, admin, health, public};
 
 #[derive(OpenApi)]
 #[openapi(
-    paths(health::live, health::ready, public::list_objects, public::get_object),
+    paths(
+        health::live,
+        health::ready,
+        public::list_objects,
+        public::get_object,
+        admin::login,
+        admin::logout,
+        admin::me,
+        admin::list_users,
+        admin::set_visibility
+    ),
     components(schemas(
         health::Live,
         health::Ready,
         public::PublicView,
-        public::PublicObjectPage
+        public::PublicObjectPage,
+        admin::LoginRequest,
+        admin::UserView,
+        admin::VisibilityRequest
     )),
     info(title = "Collection Management System", version = "0.0.0")
 )]
@@ -20,7 +33,9 @@ struct ApiDoc;
 /// product name is never hardcoded.
 async fn openapi_json(State(state): State<AppState>) -> Json<utoipa::openapi::OpenApi> {
     let mut doc = ApiDoc::openapi();
+
     doc.info.title = state.app_name.clone();
+
     Json(doc)
 }