feat: add spender user, device token, and mobile API specs

[Aniruddha-Shriwant]

Description

Adds the missing OpenAPI contracts for Task 5 (spender user, device-token, and mobile APIs):

• GET /spender/device_token
• POST /spender/device_token
• POST /spender/employees/unverify_mobile
• POST /spender/users (bare route; resolves to the "post" pseudo-action -> UserUpdate)
• POST /spender/users/change_password
• GET /spender/users/password_required

All six operations are marked x-internal: true (hidden from rendered public documentation, raw contract remains in the public repository/bundle). Follows the existing repo precedent of documenting each concrete Flask action_schema_map action as its own literal path (e.g. spender@employees@mark_active.yaml) rather than a generic {action_name} templated path, since no role in this repo currently uses that pattern.

Extends the existing but previously-unused user_out schema in src/components/schemas/user.yaml (zero prior consumers, so safe to extend) with is_email_verified, is_onboarded, password_changed_at, and signup_params to match what UserROVAPISchema actually dumps. Adds a new device_token.yaml shared schema.

Runtime verification

• Traced all six routes, blueprints, views, schemas, and action classes in platform-api at c1beddd6fc1a2d1aeecb45a6049b299b9673af2c.
• Confirmed BaseView.dispatch_request (api/flask/view.py) resolves the bare POST /spender/users through the "post" pseudo-action key in action_schema_map, not a plain upsert; and that change_password is the only real templated action (a literal URL action name of "post" is explicitly blocked).
• Verified via a sandboxed Schema().dump(None) exec inside the running platform-api container that actions returning None (e.g. ChangePassword.action, UnVerifyMobile.action) serialize to {}; documented those operations with a bare 200 and no response content, matching the existing mark_active-style convention.
• Mapped every error status to the exact assertion helper used in libs/assertions.py (assert_valid->400, assert_found->404, assert_true->403, assert_auth->401) instead of assuming by convention -- e.g. password_required's "User not found" check uses assert_valid (400), not assert_found (404).
• Confirmed is_email_verified, is_onboarded, password_changed_at, and signup_params are nullable at the DB level via db-migrations/tests/columns/list/expected.csv.
• None of these six operations have existing API YAML fixtures in platform-api; recorded as a deferred-testing-phase gap, consistent with Tasks 1/2/4.

Docs validation

• Bundled all 11 role specifications with @redocly/cli@2.19.0 (the CI-pinned version); all succeeded.
• Since user.yaml and device_token.yaml are shared components, bundled every role root (not just spender) and diffed each non-spender role against the exact base commit (69bb2641) to confirm zero fan-out impact.
• reference/spender.yaml diff is purely additive.
• Confirmed all 6 operations retain x-internal: true after bundling, at the correct operation-level placement (sibling of tags/summary/operationId), matching the repo's existing marker-placement precedent.
• platform-api worktree and fyle-platform-docs submodule pointer are unchanged.

Clickup

Task link was not provided; repository-check placeholder: https://app.clickup.com/