fix doc

apps/api/internal/httpapi/v1_openapi.go

@@ -14,8 +14,6 @@ info:
     The public API is hosted by Descrybe (customers do not self-host this surface).
 
     - Production: https://descrybe.io/api/v1
-    - Local (web / Vite proxy): http://localhost:28472/api/v1
-    - Local (Go API direct): http://localhost:28471/api/v1
 
     OpenAPI document: GET https://descrybe.io/api/v1/openapi.yaml
 
@@ -23,9 +21,6 @@ info:
 
     All /api/v1 operations require a company API key except:
 
-    - GET /health (public liveness)
-    - GET /openapi.yaml (this document)
-
     Document-level security is BearerAuth OR ApiKeyAuth (same key value).
     Do not send dashboard session cookies or CSRF tokens to /api/v1.
 
@@ -48,10 +43,7 @@ info:
     4. Store it securely. Later list/revoke shows only key_prefix (first 10
         characters). Revoked keys fail auth immediately.
 
-    ### Cutover / migration (reissue)
+    API keys are created in Settings -> API keys
-
-    API keys from the previous Descrybe platform were not migrated. After
-    cutover, integrations must create a new dk_ key in Settings -> API keys
     (or Use my API key on /docs). Pre-cutover secrets return the same HTTP 401
     Unauthorized as unknown keys — there is no separate “legacy key” error.