#935 Rebuilt image resolves spectree 3.0.0 (unpinned, no lockfile): API crash-loops at import in api/openapi/__init__.py

Found during #912. 'docker compose build api' on 2026-10-15 resolved spectree 3.0.0 (old image had 2.0.1; pydantic 2.13.4 -> 2.14.1). API process fails at import: spectree.errors.SpecTreeValidationError: apiKey type requires field_in, name field(s), but only found name (api/openapi/__init__.py:46 SpecTree(...) security_schemes). Enterprise repo has no lockfile; Dockerfile does 'uv pip install -e .[dev,apps-all]' so every rebuild floats all deps. Stopgap applied in working tree under #912: pyproject spectree>=1.2.0,<3. Real fix: lock enterprise deps (see #920) and migrate security_schemes to spectree 3 field_in, or keep the cap deliberately.