fix(api): completedAt: null for non-complete states; OpenAPI spec sync

Task #19 — API response polish.

Changes to artifacts/api-server/src/routes/demo.ts:
- checkRateLimit() return type extended: { allowed, resetAt, remaining }
- remaining = RATE_LIMIT_MAX - 1 on first request (count just incremented to 1)
- remaining = 0 when rate limited (count >= max)
- remaining = RATE_LIMIT_MAX - entry.count after each subsequent increment
- X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers set on
  ALL responses (200, 400, 429, 500) — not just 429s
- Reset value is Unix epoch seconds (Math.floor(resetAt / 1000))

Changes to artifacts/api-server/src/routes/jobs.ts:
- base object now includes createdAt: job.createdAt.toISOString() for all states
- complete state response adds completedAt: job.updatedAt.toISOString()
  (updatedAt is set to new Date() at completion time in runWorkInBackground)
- POST /api/jobs response includes createdAt: createdAt.toISOString()
  (captured as new Date() before transaction, also passed explicitly to insert)

Verification:
- 20/20 testkit PASS (full run after server restart to reset in-memory quota)
- TypeCheck: passing (pre-push hook confirmed)
- Lint: passing (pre-push hook confirmed)
- Gitea PR #28 squash-merged to main

No DB schema changes. No migration needed.

artifacts/api-server/src/routes/jobs.ts

@@ -309,6 +309,7 @@ router.get("/jobs/:id", async (req: Request, res: Response) => {
       jobId: job.id,
       state: job.state,
       createdAt: job.createdAt.toISOString(),
+      completedAt: job.state === "complete" ? job.updatedAt.toISOString() : null,
     };
 
     switch (job.state) {
@@ -356,7 +357,6 @@ router.get("/jobs/:id", async (req: Request, res: Response) => {
       case "complete":
         res.json({
           ...base,
-          completedAt: job.updatedAt.toISOString(),
           result: job.result ?? undefined,
           ...(job.actualCostUsd != null ? {
             costLedger: {

lib/api-spec/openapi.yaml

@@ -319,24 +319,68 @@ paths:
       responses:
         "200":
           description: Demo result
+          headers:
+            X-RateLimit-Limit:
+              schema:
+                type: integer
+              description: Maximum requests allowed per window (always 5)
+            X-RateLimit-Remaining:
+              schema:
+                type: integer
+              description: Requests remaining in the current window
+            X-RateLimit-Reset:
+              schema:
+                type: integer
+              description: Unix epoch seconds when the rate limit window resets
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/DemoResponse"
         "400":
           description: Missing or invalid request param
+          headers:
+            X-RateLimit-Limit:
+              schema:
+                type: integer
+            X-RateLimit-Remaining:
+              schema:
+                type: integer
+            X-RateLimit-Reset:
+              schema:
+                type: integer
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
         "429":
           description: Rate limit exceeded
+          headers:
+            X-RateLimit-Limit:
+              schema:
+                type: integer
+            X-RateLimit-Remaining:
+              schema:
+                type: integer
+                description: Always 0 when rate limited
+            X-RateLimit-Reset:
+              schema:
+                type: integer
           content:
             application/json:
               schema:
                 $ref: "#/components/schemas/ErrorResponse"
         "500":
           description: Server error
+          headers:
+            X-RateLimit-Limit:
+              schema:
+                type: integer
+            X-RateLimit-Remaining:
+              schema:
+                type: integer
+            X-RateLimit-Reset:
+              schema:
+                type: integer
           content:
             application/json:
               schema:
@@ -379,10 +423,15 @@ components:
       type: object
       required:
         - jobId
+        - createdAt
         - evalInvoice
       properties:
         jobId:
           type: string
+        createdAt:
+          type: string
+          format: date-time
+          description: ISO 8601 timestamp of job creation
         evalInvoice:
           $ref: "#/components/schemas/InvoiceInfo"
     JobState:
@@ -451,11 +500,21 @@ components:
       required:
         - jobId
         - state
+        - createdAt
       properties:
         jobId:
           type: string
         state:
           $ref: "#/components/schemas/JobState"
+        createdAt:
+          type: string
+          format: date-time
+          description: ISO 8601 timestamp of job creation (always present)
+        completedAt:
+          type: string
+          format: date-time
+          nullable: true
+          description: ISO 8601 timestamp of job completion; null when not yet complete
         evalInvoice:
           $ref: "#/components/schemas/InvoiceInfo"
         workInvoice: