[brainx]

Dashboard backends can discover the authenticated credential's effective permissions and allowed endpoint templates through GET /capabilities and /v1/capabilities. Discovery performs no database reads or runtime probes, never lists other integrations, and distinguishes operations that can change domain/lifecycle state or migrate the database.

Stacked on #50; the diff contains only capability discovery and contract completion.

• Add stable OpenAPI operation IDs, concrete capability schemas, permission metadata and complete shared errors/response headers while preserving existing success schemas and the exact readiness payload.
• Recognize named-only authentication in the doctor configuration report without relaxing the non-loopback administrator-key requirement.
• Document Olymp's pinned contract fixture update and continued runtime/schema compatibility gate. No schema migration, merge or release.

Verification: 63 capability, repository-contract, operator-interface and module-size tests passed. A separate 42-test capability/integration/diagnostic run passed. Targeted Ruff, mypy, Bandit and git diff --check passed. No live Olymp deployment or tunnel test was performed.