docs(api): openapi gaps for RI exchange execute/quote and group system_managed #1521

Non-blocking findings from the cold reviews of #1511 and #1513 (both merged). In each case internal/api/openapi.yaml doesn't match what the handlers accept or return.

RI exchange (from #1511):

• Execute still marks targets required, but the handler also accepts the legacy single-target form, target_offering_id plus target_count. Those fields are undocumented, and targets items are a bare object with no schema.
• The quote request body is a bare object, so its optional region is undocumented.
• Execute region and quote Region have no minLength: 1, so the spec accepts the empty string the handler rejects with a 400. The handler also doesn't trim spaces from the region; AWS rejects a whitespace-only value, so this causes no wrong-region spend.
• ExchangeResult.quote in frontend/src/types.ts (~925-927) is typed with a required Region, but the execute response's quote has no Region (handler_ri_exchange.go ~2191-2194). Nothing reads it today.

Groups (from #1513):

• system_managed on the Group schema isn't marked readOnly. Clients can't set it (no request type has the field), so this affects the docs only.
• The UpdateGroupAPI system-managed guard is now redundant with the service-level guard. Removing it passes every test, so the order of the 403 and the permission-ceiling error isn't pinned by a test.

Acceptance: the spec documents each accepted request shape and marks server-set fields readOnly. The frontend type matches the execute response. A test pins the group 403 ordering, or the redundant guard is removed.

🤖 Generated with Claude Code