Capture the analysis, card, share and pin routes from dev into the client contract #31

spec-kit's served OpenAPI capture, strict-field pointers and scenario steps do not yet cover the routes DevelopmentFinanceObservatory/apis#170 and #173 add, because they are captured from the deployed service. Until the capture lands, the TypeScript SDK reads the analysis, derived-frame, card, share and pin replies untyped, and no scenario exercises them.

The capture must include the analysis and anchor routes, the derived manifest and file routes, card create and read with retention, share create, replace, snapshot, unshare, slot card, slot data and history (with its limit, before and next), and pin. The strict-field list prepared for it (33 pointers, DerivedManifest.retention among them) makes both SDKs raise contract_violation when such a field is missing, so it lands with the capture. The history entry's component_id, revision and frame pointers stay out of the strict list, since an entry for a slot a replace left empty carries none of them.

Done when

• The OpenAPI capture is taken from dev after the dfo-apis stack deploys, and both SDKs regenerate their wire types from it.
• Scenario steps cover analysis, card, share, replace, snapshot, unshare, history and pin, with synthetic refusal scenarios, and both SDKs replay them.
• The strict-field pointers are in the contract, and both SDKs pass against dev.