API Contract Testing

Catches the specific failure mode where backend and frontend independently drift — the backend renames or restructures a field, tests still pass (frontend isn't exercised by pytest), and the UI silently breaks or shows `undefined`.