fix(api): /claim/preview emits items envelope alias for resources (B5-P1-3)

[mastermanas805]

Summary

• /claim/preview shipped with envelope field resources, but every other list endpoint on the platform (/api/v1/resources, /api/v1/deployments, /api/v1/audit, /api/v1/backups, /api/v1/team/invitations) uses items. Agents generated against the OpenAPI snapshot had to special-case this one envelope shape.
• This PR adds items as the canonical alias on both response branches (already_claimed empty + happy-path with rows) while keeping resources populated as a deprecated legacy alias. No break for the dashboard / sdk-go / existing curl recipes.
• OpenAPI ClaimPreviewResponse schema marks resources deprecated and routes new clients at items. Snapshot regenerated via `make openapi-snapshot`.
• B5-P1-3 (BugBash 2026-05-20 master ledger).

Coverage block (rule 17)

```
Symptom: /claim/preview emits resources, not items
Enumeration: grep -n '"resources":\|"items":' internal/handlers/onboarding.go
Sites found: 2 (already_claimed branch, happy path)
Sites touched: 2 (both arms emit both keys)
Coverage test: TestClaimPreview_ItemsAlias_AlreadyClaimedBranch +
TestClaimPreview_ItemsAlias_HappyPathBranch — both
assert items AND resources are present and equal-length
on each branch.
Live verified: Awaiting deploy + curl /claim/preview?t= | jq '.items'
```

Rule 22 surface

• `internal/handlers/onboarding.go` (the bug — both emit sites)
• `internal/handlers/openapi.go` (ClaimPreviewResponse schema; items canonical, resources deprecated)
• `openapi.snapshot.json` (regenerated)
• `internal/handlers/claim_preview_items_alias_test.go` (coverage gate, both branches)

Test plan

• `go test ./internal/handlers/ -run 'TestClaimPreview' -count=1 -short` → ok
• `make openapi-snapshot-check` → snapshot matches handlers.OpenAPISpecProduction()
• CI green
• After deploy: `curl /claim/preview?t= | jq '.items, .resources'` both non-null

🤖 Generated with Claude Code