make the test suite and openapi generator platform-independent

Windows checkouts turned LF into CRLF (core.autocrlf=true), and several
tests plus the openapi generator hardcoded LF or POSIX path separators.
The result was a suite that was green on Linux CI but red on Windows, and
an openapi.json whose /api/hermes/* routes silently disappeared when
generated on Windows.

Pin the repository to LF via .gitattributes, strip shebangs before
Vite's SSR transform, and key route files by their posix path. Add a
manually triggered macOS verification workflow so the same checks run
on a self-hosted macOS runner.

scripts/generate-openapi.mjs

@@ -95,7 +95,11 @@ function scanRoutes() {
   const hermesRouteFiles = readdirSync(hermesRoutesDir).filter(f => f.endsWith('.ts'))
 
   for (const file of hermesRouteFiles) {
-    const routePath = join('hermes', file)
+    // 必须用 posix 风格的 key 去查 tagMappings：join() 在 Windows 上返回
+    // 'hermes\kanban.ts'，而映射表里的 key 是 'routes/hermes/kanban.ts'，
+    // 查不到就会把这个路由文件整个跳过 —— 结果是生成的 openapi.json 里
+    // 所有 /api/hermes/* 路由全部消失。
+    const routePath = `hermes/${file}`
     const tagInfo = tagMappings[`routes/${routePath}`]
     if (tagInfo) {
       scanRouteFile(join(hermesRoutesDir, file), tagInfo, paths)