Extraction readiness and validate

[chetanr25]

Extraction readiness and validate

After extraction, the responder has to pick a form with nothing telling them which forms can actually be generated. They pick one, generation runs, and only then does a missing required field show up. These two endpoints answer it up front.

• GET /extract/{extract_id}/readiness checks the contract against every active template and returns, per template, ready or not plus the fields blocking it. That is the form selection screen.
• POST /extract/{extract_id}/validate is the same check for one template, so the UI can recheck the form the user is looking at after a correction instead of rebuilding the whole matrix.
• Both run one engine, so they cannot disagree. A test asserts that.

How a field is checked:

• Schema fields read the contract path they declare. Static fields carry their own text. Manual and open fields read their key under custom_fields, which is flat, so the key is read directly instead of walked.
• Missing means null, blank string, empty list or empty object. Zero and false are values.
• Coverage is filled over total fields. Warnings are built from the recommended fields that came back empty, no rule table per form type.
• The matrix lists active templates only. Validate still checks a legacy or draft template if you ask for it by id, which is what you want while testing a template you just registered.

Contract change: validate listed only a 404. It can also return 409 when the extraction has not completed, same as readiness, so that response was added first.

Note: open template fields are not extracted yet, so a required open field always reports as a gap. The answer stays correct, just stricter than it will be later.

Tested live against the running stack as well as in the suite. Real extraction, then the readiness matrix, the correction loop and every error path. 31 new tests, both endpoints answer in about 5 ms.

Closes #551