feat: add composition API product authoring

[bokelley]

Summary

• Adds admin composition API endpoints for profile-backed wholesale product authoring, alongside existing inventory profile and signal authoring.
• Wires tenant-authored signals into live buyer discovery/activation and advertises signals capabilities on the platform surfaces.
• Adds OpenAPI export/contract coverage so composition routes stay registered and docs remain management-key protected.

Expert review

• Ran code review and security review; addressed docs exposure, signal activation validation, pricing replacement safety, async tool contract detection, and CPM-only authoring drift.

Tests

• make quality
• scripts/run-test.sh tests/integration/test_composition_api.py tests/integration/test_tenant_signal_flow.py -q
• uv run pytest tests/unit/test_openapi_export_in_sync.py tests/unit/test_architecture_no_raw_select.py tests/unit/test_architecture_repository_pattern.py -q
• Pre-push hook: unit + integration + uv-secure (test-results/220526_1921/)
• Local served-app e2e against real HTTP admin API and MCP: created inventory profile, signal, and product; verified buyer get_products and get_signals discover them.

Note: I also attempted the Docker e2e harness (./run_all_tests.sh ci tests/e2e/test_composition_api_e2e.py -q), but it blocked before app tests on global Docker buildx contention resolving docker/dockerfile:1.4. The same e2e path passed against a locally served app with the agent Postgres DB.

[bokelley]

Closing: this PR was opened against prebid/salesagent by mistake. The work is intended for bokelley/salesagent.