OpenAPI spec omits `/merchants`, `/ready`, `/`, and all auth

[Darkdruce]

Summary

openapi.yaml documents payments/webhooks/health but not merchant provisioning, readiness, the root banner, or any security scheme.

Location

• openapi.yaml (no /merchants, /ready, /, no components.securitySchemes)

Details & impact

The spec is incomplete and implies the API is unauthenticated, misleading SDK generators and integrators.

Suggested fix

Add the missing paths and a bearer securityScheme applied to protected routes.

Acceptance criteria

• OpenAPI covers every route and documents auth.