feat: add REST API with tRPC-to-OpenAPI

[kushpvo]

Description

Adds a REST API to SplitPro using trpc-to-openapi, exposing a curated
subset of existing tRPC procedures at /api/v1/* for integrations with
external tools (Actual Budget, Firefly III, bots, etc.).

What's included

• API key authentication — Prisma model, CRUD in Account Settings,
  middleware that validates X-API-Key header, throttled lastUsedAt
• Endpoints:
  • GET /me, GET /friends
  • GET /groups, GET /groups/{id}, GET /groups/{id}/balances,
    GET /groups/{id}/expenses
  • GET /expenses, GET /expenses/{id}
  • POST /expenses, PUT /expenses/{id},
    DELETE /expenses/{id}
  • Pagination (since, limit, offset) and groupId filtering
• OpenAPI spec at /api/openapi.json and Swagger UI at /api/docs
• Mutations delegate to splitService — create, update, and delete
  use existing service functions for transactional safety, group
  membership validation, recurrence handling, and push notifications
• All amounts in integer cents across every endpoint
• API key limit — max 10 keys per user

Architecture

The openapi.ts router is a thin mapping layer: REST JSON input →
CreateExpense format → splitService, with no duplicated business
logic. The createOpenApiContext in trpc.ts authenticates API keys
and synthesizes a session for use with protectedProcedure.

Closes #615

---

Demo

Swagger UI at /api/docs:

Example request:

curl -H "X-API-Key: sp_xxx" https://instance/api/v1/me
{
  "id": 150,
  "name": "test",
  "email": "test@example.com",
  "currency": "USD"
}

Disclaimer

AI was used to create this PR. All code has been throughly reviewed and tested locally.

Checklist

• I have read CONTRIBUTING.md in its entirety
• I have performed a self-review of my own code
• I have added unit tests to cover my changes
• The last commit successfully passed pre-commit checks
• Any AI code was thoroughly reviewed by me