feat: add SAT OpenAPI 3.1 specification

[dmchaledev]

Summary

• Adds sat/openapi.yaml — the OpenAPI 3.1 spec for the HailBytes Security Awareness Training API, which is the only file listed in the README contents table and Quick Start section that didn't exist yet.
• Follows the exact same conventions as asm/openapi.yaml: pagination envelope, PascalCase $ref parameters, nullable fields, rate-limit headers, and consistent ID patterns.
• CI (validate-openapi.yml) is already wired to lint this file with Spectral once it exists — this PR activates that check.

Resources covered (6 tags, ~20 endpoints):

Tag	Key endpoints
Users	GET/POST /users, GET/PATCH/DELETE /users/{id}
Groups	GET/POST /groups, GET/PATCH/DELETE /groups/{id}
Campaigns	GET/POST /campaigns, GET/PATCH /campaigns/{id}
Simulations	GET/POST /simulations, GET /simulations/{id}
Enrollments	GET/POST /enrollments
Reports	GET /reports/compliance, GET /reports/phishing

Schemas include summary (User, Campaign, …) and detail (UserDetail, CampaignDetail, SimulationDetail) variants with read-only aggregate fields (completion rates, phish-prone percentages, click/report rates).

Test plan

• CI Spectral lint passes on sat/openapi.yaml with --fail-severity warn
• All $ref targets resolve (no dangling references)
• Quick Start example in README — POST /sat/v1/users with email + group_id — matches the spec's UserCreate schema
• ID patterns in spec (usr_, grp_, cmp_, sim_, enr_) are internally consistent across path parameters, query filters, and schema examples

https://claude.ai/code/session_01XhL2QtZ93S9ZdqUQ5Xz6wP

---

Generated by Claude Code