## Issue description
`src/Surypus/API/OpenApi.hs` is an exposed/public module but lacks a Haddock module header and the exported `apiSwaggerSpec` is undocumented.

## Issue Context
The project requires Haddock documentation for public modules and public API functions.

## Fix Focus Areas
- src/Surypus/API/OpenApi.hs[1-8]

## Issue description
The new Bash script uses tab indentation, which violates the project's formatting rules.

## Issue Context
Consistent whitespace (2 spaces, no tabs) is required to reduce diff noise and keep formatting consistent.

## Fix Focus Areas
- scripts/ci-runner.sh[15-19]

## Issue description
New test code constructs `Text` with raw string literals (via type annotations) instead of `T.pack`.

## Issue Context
The test suite convention requires `T.pack "..."` when a `Text` value is intended.

## Fix Focus Areas
- test/API/ServerSpec.hs[109-111]

### Issue description
The DB readiness loop can silently time out and continue, which makes failures later in the job misleading/flaky.

### Issue Context
Both the GitHub Actions workflow and `scripts/ci-runner.sh` do a bounded wait loop but don’t exit non-zero when Postgres never becomes ready.

### Fix Focus Areas
- .github/workflows/ci.yml[24-32]
- scripts/ci-runner.sh[13-20]

### Implementation notes
- Track a `ready=0/1` flag inside the loop (or check `pg_isready` once after the loop).
- If not ready after the loop, print a clear error and `exit 1`.
- (Optional) Dump `docker-compose logs db` on failure for faster diagnosis.

### Issue description
swagger.json encodes `parameters` as an object map, not an OpenAPI parameters array, which breaks validators/codegen.

### Issue Context
Several operations include `"parameters" .= object [...]`.

### Fix Focus Areas
- src/Surypus/API/OpenApi.hs[160-172]
- src/Surypus/API/OpenApi.hs[200-233]
- src/Surypus/API/OpenApi.hs[383-433]

### Implementation notes
- Change each `"parameters"` value to a JSON array (`[ ... ]`).
- For query params, each entry should include at least `{ "name": "limit", "in": "query", "schema": {"type": "integer"} }`.
- For path params like `{id}`, mark `{ "name": "id", "in": "path", "required": true, "schema": {"type": "integer"} }`.

### Issue description
swagger.json documents health endpoints that the Servant API does not implement.

### Issue Context
This inconsistency makes the published spec unreliable for clients.

### Fix Focus Areas
- src/Surypus/API/OpenApi.hs[41-62]
- src/Surypus/API/Root.hs[200-203]

### Implementation notes
Choose one:
1) Remove `/api/v1/health/live` and `/api/v1/health/ready` from `apiSwaggerSpec`, or
2) Implement them in the Servant API by extending `HealthAPI` and adding handlers in `Surypus.API.Server`.

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 24 - 32, The "Start DB and API" step's
readiness loop must exit non-zero when Postgres never becomes ready; modify the
block containing the docker-compose up and the for loop that runs
`docker-compose exec -T db pg_isready ...` so that after the loop you detect if
the loop exhausted all attempts (e.g., via a readiness flag or checking the
final pg_isready result) and if so print an error like "DB did not become ready"
and `exit 1` to fail the job immediately instead of letting later steps fail
with misleading errors.

Verify each finding against the current code and only fix it if needed.

In `@scripts/ci-runner.sh` around lines 1 - 12, Add a cleanup trap so the compose
stack is torn down on both success and failure: define a function (e.g.,
cleanup) that runs docker-compose down --remove-orphans (and optionally stops
specific services) and ensure you register it with trap 'cleanup' EXIT (and/or
ERR) near the top of the script; update references around docker-compose up -d
db api and LOG_DIR/BUILD_LOG so the cleanup runs regardless of how the script
exits and does not rely on manual invocation.

Verify each finding against the current code and only fix it if needed.

In `@scripts/ci-runner.sh` around lines 13 - 20, The wait loop in
scripts/ci-runner.sh that checks DB readiness (for i in {1..60} ...
docker-compose exec -T db pg_isready -U surypus -d surypus) currently breaks on
success but does not fail the script if the loop completes without ever
succeeding; modify the script to detect a timeout after the loop (e.g., check
whether the loop exited via break or not) and if the DB never became ready echo
an error to "$BUILD_LOG" and exit with a non-zero status (exit 1) so downstream
commands like stack build/test do not run when the DB is unavailable.

Verify each finding against the current code and only fix it if needed.

In `@src/Core/Currency/Operations.hs` around lines 95 - 98, The current code uses
Prelude.round (banker's rounding) via the expression "roundedInt = (round
scaled) :: Integer"; replace this with a custom half-up rounding helper (e.g.
roundHalfUp :: Rational -> Integer) and call it instead (e.g. roundedInt =
roundHalfUp scaled). Implement roundHalfUp to add a sign-aware 0.5 before
flooring (for positive: floor (r + 0.5), for negative: ceiling (r - 0.5) or
equivalently floor (r + 0.5 * signum r)), ensure it operates on Rational to
avoid Double tie issues, and update the duplicated algorithm in the other copy
(the implementation in src/Core/Currency.hs around the earlier rounding block)
to use the same roundHalfUp function so both paths perform half-up rounding.

Verify each finding against the current code and only fix it if needed.

In `@src/Surypus/API/OpenApi.hs` around lines 3 - 7, Add Haddock documentation:
add a module-level Haddock comment above the "module Surypus.API.OpenApi ..."
declaration describing the module's purpose and public surface, and add a
Haddock comment directly above the exported function "apiSwaggerSpec" explaining
what it returns (that it provides the Swagger/OpenAPI spec as a
Data.Aeson.Value), any important invariants or inputs, and intended usage;
ensure both comments use standard Haddock formatting (-- | for top-level docs)
and mention the module name Surypus.API.OpenApi and the apiSwaggerSpec function.

Verify each finding against the current code and only fix it if needed.

In `@src/Surypus/API/OpenApi.hs` around lines 41 - 62, The OpenApi spec lists
"/api/v1/health/live" and "/api/v1/health/ready" but the router in Root.hs only
exposes "/api/v1/health", causing mismatched docs and 404s; either remove those
two paths from OpenApi.hs or add corresponding routes and handlers in Root.hs.
If you choose to add routes, implement handlers (e.g., healthLiveHandler and
healthReadyHandler) that return 200 OK, and register them in the existing
routing table/router where the current health endpoint is defined so the OpenApi
entries "/api/v1/health/live" and "/api/v1/health/ready" match real endpoints.
Ensure handler names and route registrations match the exported symbols used by
your router so the spec and implementation stay in sync.

Verify each finding against the current code and only fix it if needed.

In `@src/Surypus/API/OpenApi.hs` around lines 165 - 172, The OpenApi parameter
blocks currently emit "parameters" as a JSON object keyed by name; update the
generators in OpenApi.hs (the code around the shown diff and the similar blocks
at lines 205-232 and 388-431) to emit an array of parameter objects instead:
each parameter should be an object with "name" (string), "in" (e.g. "query" or
"path"), "schema" containing {"type": "<type>"} and include "required": true for
path params; locate the functions building the path/item/parameters structures
in OpenApi.hs and replace the keyed-object construction with building a
list/array of these parameter objects so the produced /swagger.json conforms to
OpenAPI 3 shape.

Verify each finding against the current code and only fix it if needed.

In `@src/Surypus/API/Server.hs` around lines 143 - 150, Replace direct logging of
the raw username in the authentication path by redacting or obfuscating it
before calling debugLogIf/debugLog: in the block that uses debugLogIf (pwd /=
"admin123" && pwd /= "demo") and the subsequent debugLog on success, remove the
plain user string and instead log a safe identifier (e.g. a constant placeholder
like "<redacted-user>", a truncated prefix, or a hash of user) so the calls that
remain—debugLogIf, debugLog, generateTokenPair, persistRefreshTokenBestEffort
and construction of LoginResponse/Surypus.JWT.accessToken/refreshToken—keep
current behavior but never emit the raw user value in logs.

Verify each finding against the current code and only fix it if needed.

In `@test/API/ServerSpec.hs` around lines 106 - 112, The test uses overloaded
string literals for Text in roleBody; update the rcrName and rcrPermissions
entries to use Text.pack (e.g. replace ("admin-test" :: Text) and
(["goods:write"] :: [Text]) with Text.pack "admin-test" and map Text.pack
["goods:write"] respectively), leave the empty rcrResources as-is or ensure any
non-empty resource strings are wrapped with Text.pack; ensure Data.Text is
imported qualified as Text if not already and keep the surrounding encode/object
usage (roleBody, rcrName, rcrPermissions, rcrResources) unchanged.

Verify each finding against the current code and only fix it if needed.

In `@test/API/ServerSpec.hs` around lines 266 - 284, The tests health_live_public
and health_ready_public currently accept 401 and 404 which lets them pass when
the endpoints are missing; update both test cases to assert that the returned
status code is 200 only (remove the 401/404 acceptance), i.e. in the blocks that
call mkTestApp and runSession with jsonlessRequest for "/api/v1/health/live" and
"/api/v1/health/ready" replace the conditional that checks statusCode
(simpleStatus res) to require equality with 200 and call expectationFailure
otherwise, keeping the same helpers (mkTestApp, jsonlessRequest, runSession,
statusCode, simpleStatus).

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml at line 20, Update the GitHub Action invocation
string "uses: docker/setup-buildx-action@v2" to the current recommended major
version by changing it to "uses: docker/setup-buildx-action@v4"; locate the uses
entry in the CI workflow and replace the version tag while keeping any existing
inputs/with settings unchanged to ensure compatibility.

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 42 - 44, The "Run Tests" CI step
currently runs stack test without setting the RBAC gating variable; update the
"Run Tests" job/step named "Run Tests" so it applies
OPENPAPYRUS_SKIP_RBAC_TESTS=1 to the test invocation (either by adding an env:
OPENPAPYRUS_SKIP_RBAC_TESTS: '1' on that step or prefixing the command with the
environment variable), ensuring the stack test execution honors the RBAC
test-gating flag.