Make the OpenAPI document say what each operation answers (B07)

[AsyncAssassin]

Summary

B07 from the merged review of v0.4.0; 0.4.1 is released once all fixes are merged. Swagger is what a reviewer opens first, and its document did not match the API:

• every operation listed only 200, although creations answer 201, both sync requests 202 with Location, and ingest 201 or 200;
• no operation named an error;
• under demo the chain simulator appeared next to the API;
• the request schemas showed the validation getters isAmountValid, isDirectionValid, and isStatusValid as required fields.

What changes:

• The controllers declare their success codes with @ApiResponse, including the Location header of a new account and of a sync run.
• One OpenApiCustomizer adds the errors every operation shares, 400, 401, 403, and 503, as application/problem+json with a ProblemDetail schema. The operation-specific ones (404, 409, 415, 429) stay in docs/api.md section 14 rather than being repeated on every operation, as the review card advised.
• springdoc.paths-to-match: /api/** keeps the simulator out, and default-produces-media-type: application/json replaces */* for the success bodies.
• The validation getters are @JsonIgnore, so they leave the schemas. Bean validation still runs them.

The README section on OpenAPI and docs/testing.md describe it. CHANGELOG.md lists it under [Unreleased] → Fixed.

Verification

• ./gradlew clean check: 275 tests, 0 failures, 2 skipped (the env-gated Alchemy live smoke).
• OpenApiDocumentIntegrationTests reads /v3/api-docs under demo, sharing the context of ChainSimulatorIntegrationTests:
  • every operation has exactly its success codes, and the account and sync-run responses carry Location;
  • every operation has the four shared ProblemDetail errors;
  • there is no /simulator path;
  • no request schema names a *Valid field.
• Mutation check: documenting the simulator, a 200 on account creation, no customizer, or the amount getter back in the schema each turns a test red.
• Live demo run: the document lists the nine /api operations with 201, 202, 201/200, or 200 plus 400, 401, 403, 503. The request schemas require only the real fields. Swagger UI and /v3/api-docs.yaml still answer 200.

This PR and #15 to #20 each add a section under [Unreleased] in CHANGELOG.md, so each later merge needs a one-file rebase. With #18 it also meets in the imports of AccountDtos.kt and ObservedEventDtos.kt (both add a Jackson annotation import at the same place); that is resolved in the same rebase.

[AsyncAssassin]

Combined into #23 together with the other batch-1 fixes, so they merge without a rebase per PR. This description keeps the detailed evidence for its fix.