Document feature flags OpenAPI response

[brentthomas248]

Summary

• add a typed Swagger response DTO for the feature flags endpoint
• document success, unauthorized, and rate-limit responses on GET /v1/feature-flags
• add a Swagger metadata regression spec for the feature-flags controller

Verification

• npm test --prefix backend -- feature-flags.swagger.spec.ts --runInBand
• npm test --prefix backend -- feature-flags --runInBand
• npm run test:e2e --prefix backend -- feature-flags.e2e-spec.ts --runInBand -t "GET /v1/feature-flags returns|returns false for all flags|reflects FEATURE_NEW_SUBSCRIPTION_FLOW=true|reflects FEATURE_CRYPTO_PAYMENTS=true|reflects both flags enabled simultaneously"
• cd backend && npx --no-install eslint src/feature-flags/feature-flags.controller.ts src/feature-flags/dto/feature-flags-response.dto.ts src/feature-flags/feature-flags.swagger.spec.ts
• git diff --check -- backend/src/feature-flags/feature-flags.controller.ts backend/src/feature-flags/dto/feature-flags-response.dto.ts backend/src/feature-flags/feature-flags.swagger.spec.ts

Note: the full existing feature-flags e2e suite still has a pre-existing failing assertion for FEATURE_NEW_SUBSCRIPTION_FLOW=yes expecting false while the service currently parses yes as true; I left that runtime behavior unchanged.