chore(deps): upgrade Microsoft.OpenApi to 3.x (blocked by AspNetCore.OpenApi source generator) #279

Background

Dependabot PR #273 (Microsoft.OpenApi 2.7.5 to 3.11.0) was closed because the API project does not build:

Microsoft.AspNetCore.OpenApi.SourceGenerators.XmlCommentGenerator/OpenApiXmlCommentSupport.generated.cs(399,41):
error CS0200: Property or indexer 'IOpenApiMediaType.Example' cannot be assigned to -- it is read only

The source generator that ships with Microsoft.AspNetCore.OpenApi emits code written against the 2.x object model, so 3.x is not compatible with it yet.

Microsoft.OpenApi is deliberately pinned to 2.7.5 to resolve CVE-2026-49451 (see #165), so any move must keep that CVE fixed.

Work

• Find out which Microsoft.AspNetCore.OpenApi version (if any) supports Microsoft.OpenApi 3.x.
• Do this together with the Asp.Versioning 10 migration in chore: upgrade Asp.Versioning.Mvc to v10.0.0 #165, since both change the OpenAPI wiring (Asp.Versioning.OpenApi has its own Microsoft.OpenApi dependency).
• Add Microsoft.OpenApi major bumps to the ignore list in .github/dependabot.yml until then, if Dependabot keeps reopening it.

Acceptance criteria

• dotnet build and dotnet test pass (75% line gate)
• dotnet list package --vulnerable reports zero findings (CVE-2026-49451 stays fixed)
• Generated OpenAPI JSON is unchanged apart from intended differences, and npm run gen:api still produces a working client
• dotnet format --verify-no-changes is clean