POST /content-lock/unlock

Request body for POST /encryption/unlock-with-passphrase (ADR-008 D15).

Carries the user's plaintext passphrase over the loopback API. Per D14 the endpoint is session-JWT gated (not in PUBLIC_PATHS) and the handler MUST never log this body — see the rule in uc-webserver api/encryption.rs. This formally retires the historical "passphrase 不出进程" invariant: under the "same UID = trusted" model (D14) an attacker who can sniff loopback can already dump the master key from daemon memory, so loopback transport adds zero incremental exposure.

Canonical success envelope: { "data": T, "ts": <unix millis i64> }.

ts is chrono::Utc::now().timestamp_millis(), set in the webserver handler via [ApiEnvelope::now] (the contract carries only the type + the clock helper, not a hard dependency on when the handler reads the clock). rename_all = "camelCase" is a no-op for the single-word fields here but is declared for forward-compat.

IMPORTANT (utoipa v4): every concrete ApiEnvelope<X> that needs a named OpenAPI component is declared in the #[aliases(...)] block below. Add a new alias line whenever a new payload type needs enveloping. NEVER register the bare ApiEnvelope in components(schemas(...)) — utoipa errors on a bare generic, and an un-aliased generic inlines an anonymous schema.