docs: sync Application Client OpenAPI after verify CID routing

Matches client 3eb4a36: want_scope=global or CID-like receipt_id routes
verify to VeraeTime; AuthError note for 401.

site/openapi/application-client.yaml

@@ -33,8 +33,9 @@ info:
     | create_user | (`create_user` exists on MCP; apps use direct) | `POST /auth/users` |
 
     Routing: `local` / `shared` stamp and non-global verify / hash_report use MCP.
-    `global` / `want_scope=global` use VeraeTime directly. Auth ops always hit VeraeTime
-    with caller-held JWTs.
+    `global` / `want_scope=global` use VeraeTime directly. Verify also uses VeraeTime when
+    `receipt_id` looks like an IPFS CID (`Qm…`, `bafy…`, `bafk…`). Auth ops always hit
+    VeraeTime with caller-held JWTs.
 servers:
   - url: https://mcp.verae.ai
     description: >
@@ -72,8 +73,9 @@ paths:
       operationId: verify
       summary: Verify a receipt
       description: |
-        Verify by `receipt_id`. Use `want_scope=global` (or a global receipt) for
-        VeraeTime `POST /api/verify`; otherwise MCP tool `verify`.
+        Verify by `receipt_id`. Routes to VeraeTime `POST /api/verify` when
+        `want_scope=global` or `receipt_id` looks like an IPFS CID (`Qm…`, `bafy…`,
+        `bafk…`); otherwise MCP tool `verify`.
       tags: [timestamping]
       requestBody:
         required: true
@@ -272,7 +274,9 @@ components:
           type: string
         want_scope:
           type: string
-          description: Set to global to force VeraeTime verify.
+          description: >
+            Set to global to force VeraeTime verify. CID-shaped receipt_id
+            (Qm… / bafy… / bafk…) also uses VeraeTime without this flag.
           enum: [local, shared, global]
     VerifyResponse:
       type: object