Add zero-dependency REST demo and CI-friendly exits

[device-kunkun]

What changed

• add a dependency-free local REST server with deterministic GET /health and POST /echo endpoints
• add a matching OpenAPI document and an end-to-end test that sends three real HTTP requests and verifies both reports
• add --fail-on-failure so CI can receive exit code 1 after failed checks while reports are still written
• reject transport failures in negative cases and reject non-object JSON responses when response fields are required
• sharpen the README first-run path and document supported-scope limitations explicitly
• add a changelog, structured bug/feature Issue Forms, a pull request checklist, and a concrete contribution guide

Why

The existing REST example requires Java, MySQL, and local credentials, which makes the first OpenAPI workflow expensive to try. In addition, negative cases could be reported as passing when no HTTP response was received because a connection error was treated like the expected HTTP failure. The CLI also always returned success after completed validation, making report failures hard to enforce in CI.

User and developer impact

New users can run the full OpenAPI parse → generate → execute → validate → JSON/HTML report path with Python's standard library only. Existing commands keep their previous exit behavior unless --fail-on-failure is supplied. The demo listens on 127.0.0.1 by default and uses only synthetic data.

Validation

• isolated Python 3.9 virtual environment: editable install and pip check succeeded
• python -m unittest discover -s tests -v: 8/8 passed
• python -m compileall -q src sample_targets tests: passed
• installed api-testkit smoke test against the local demo: 3/3 passed; JSON and HTML reports created
• mvn -f java-springboot-sample/pom.xml -B -ntp verify: passed
• mvn -f java-springboot-sample/pom.xml -B -ntp dependency:analyze: completed successfully; it retains pre-existing Spring Boot starter aggregation warnings about transitive imports and apparently unused starters
• git diff --check: passed
• all Issue Form YAML parsed successfully; required top-level fields and unique input IDs validated
• README local link targets verified
• credential/token and local D/E-drive path scan: 0 findings

Scope and risk

• no external service, credential, database, repository setting, or release is involved
• the supported OpenAPI subset is unchanged
• the new exit code is opt-in, so existing automation remains compatible