v1.0.0 — stable API milestone

Spec-first JSON-everywhere REST API + 5 text-to-audio engines. Skips
the v0.24.x line; this tag is both the breaking refactor and the 1.0
stability commitment. Every v0.23.x client breaks.

API contract (now stable under semver):
  - Every audio endpoint takes a JSON body.
  - Multipart only at PUT /v1/files/{path}.
  - Audio-producing endpoints require output_path xor output_url.
  - Raw audio bodies + *_base64 MCP fields removed.
  - openapi.yaml is the source of truth; Pydantic models regenerate via
    `make generate`; handler signatures take a single Pydantic body.

NEW engines (POST /v1/audio/generate/{engine}, all CUDA-only):
  - stable-audio-open  (Stability Community Licence; 47 s cap; ~12 GB)
  - musicgen-small     (CC-BY-NC; AUDIOLLA_ENABLE_NONCOMMERCIAL=1 gate)
  - musicgen-medium    (CC-BY-NC; same gate; higher quality)
  - riffusion          (CreativeML OpenRAIL-M; spectrogram + Griffin-Lim)
  - audioldm2          (CC-BY 4.0 — commercial-safe, no opt-in)

Plus: matchering/resampy 500 fix (setuptools pinned in heavy-deps),
openapi.yaml audit (tags + reusable parameters + standard error set,
17 routes backfilled, paths 73 -> 90), FastAPI serves the static
openapi.yaml at /openapi.json, JobAcceptedResponse.status_url contract
fix, AudioSeparateRequest.engine field fix, spec-first contract in
CLAUDE.md.

Smoke: unit 347/347, CPU e2e 63/63 scripts (398/398 tests), CPU + CUDA
images build clean.

Migration cheatsheet in CHANGELOG.md.