codeSplitters: OpenAPI spec + personal API tokens, so outside agents (e.g. via Executor) can use the app #383

Since #380, agents inside the browser can drive codeSplitters through the ⌘K palette as WebMCP tools. Agents outside the browser (Claude Code, Cursor, or anything going through an MCP gateway like Executor) can't yet. The palette is the starting point, but three things are missing:

1. Request bodies. The palette shows each command's route (POST /api/repos/:o/:r/shares), but the body ({path, from, to}) only exists in the JS that sends it. Write an OpenAPI spec for /api covering every palette command's route, with request and response shapes.
2. Read routes. Tree, file lines/blame, branches and branch review, cuts and shares are loaded by each view directly, not through the palette. Add them to the spec. (The WebMCP read tools in client.html are a checklist: list_files, read_file, current_page.)
3. Auth for non-browser callers. Today the API takes a cookie only: an alias (desktop) or a Better Auth session. Add personal API tokens: create/revoke from the profile page, sent as Authorization: Bearer …, act as the user, and count against the same rate limits. This is the one real new feature and needs a security pass: scopes? Never valid for admin routes? Expiry?

Done when: the spec is served (e.g. GET /api/openapi.json), and Executor (v2 beta) loads it with a token and calls one read and one write, with risky ones (delete repo, merge, commit, deploy) set to need approval in Executor's policy.

Supersedes #379 (a generated API reference covers its "build your own UI" goal too).