fix: restore Instructions report and profile contracts

[andrei-hasna]

Summary

• make instructions report --json emit the documented schema_version: 1 JSON envelope
• preserve the existing no-flag human report byte-for-byte
• declare the implemented profile membership add/remove routes in OpenAPI with write authentication, exact path/body parameters, HTTP 200 response schemas, and regenerated SDK methods

Tasks

• O2-00094: 96939009-8cd2-43a5-b88e-251596b4f591
• O2-00095: f5700c0d-dd7d-4850-a092-38656610c4be

Exact candidate

• base main: 7b0bee0e708f297032f7578dd44572ea8f3e84a1
• head: 2020c16d15a04a2263b28679ad5472bb9e5bcdf4
• tree: 42893e7202cefd73ea9d5b343d926024e0d475aa

Verification

• bun test src/cli/output.test.ts src/server/profile-contract.test.ts — 13 pass, 0 fail
• bun test — 665 pass, 0 fail
• bun run typecheck — exit 0
• bun run build — exit 0
• bun run kit:check — exit 0
• built CLI acceptance — json_cmd_rc=0 json_parse_rc=0 human_cmd_rc=0 human_cmp_rc=0
• staged secret scan — findingCount: 0, 6 files scanned, untruncated
• changed-range secret scan — findingCount: 0, 14,420 bytes scanned, untruncated
• git diff --check origin/main...HEAD — exit 0

Rollback

Revert commit 2020c16d15a04a2263b28679ad5472bb9e5bcdf4; no database migration, publish, install, render, deployment, or activation is included.

[andrei-hasna]

[REVIEW] GO — #81 @ 2020c16 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Reviewed the complete origin/main...HEAD diff at base 7b0bee0e708f297032f7578dd44572ea8f3e84a1 and the surrounding implementation for all six changed files: README.md, sdk/src/v1.generated.ts, src/cli/index.tsx, src/cli/output.test.ts, src/server/openapi.ts, and src/server/profile-contract.test.ts. I also traced the reachable profile membership handlers, instructions:write middleware, local and cloud profile stores, SDK generator, and top-level SDK exports.

Commands and gates:

• git log --oneline origin/main..HEAD — exit 0.
• git diff origin/main...HEAD --stat — exit 0.
• full diff of every changed file — exit 0.
• bun install — exit 0; setup only, not counted as a repository gate.
• bun run typecheck — exit 0; 0 TypeScript diagnostics.
• bun run test — exit 0; 665 pass, 0 fail, 2794 assertions across 56 files.
• git diff --check origin/main...HEAD — exit 0.
• post-gate git status --short --branch — exit 0; clean worktree.

Blocking P0/P1 findings: none.

Security/correctness trace: the newly documented profile membership mutations correspond to existing handlers and storage operations, use encoded path parameters in the generated client, and remain protected by the server's write-scope API-key middleware. The report JSON path returns before the human renderer and its new tests cover both surfaces.

Non-blocking follow-ups: none.