feat(api): GET /api/missions + POST /api/missions/{id}/accept

Routes call ensureSave first (mission functions assume an initialized save),
map MissionError to 404/409 and non-integer path ids to 400. OpenAPI spec in
code gains both paths + the Mission schema (12 -> 14 paths); openapi.test.ts
covers the new shapes.

app/api/missions/[id]/accept/route.ts

@@ -0,0 +1,24 @@
+import { getGameDb } from '@/lib/db/client'
+import { ensureSave } from '@/lib/game/save'
+import { acceptMission, MissionError } from '@/lib/game/missions'
+
+// Accept an AVAILABLE mission — it becomes the single active one. Costs a turn; returns the fresh board.
+export async function POST(_req: Request, ctx: { params: Promise<{ id: string }> }) {
+  const db = await getGameDb()
+  await ensureSave(db) // acceptMission assumes a save exists
+
+  const { id } = await ctx.params
+  const missionId = Number(id)
+  if (!Number.isInteger(missionId)) {
+    return Response.json({ error: 'mission id must be an integer' }, { status: 400 })
+  }
+
+  try {
+    return Response.json(await acceptMission(db, missionId))
+  } catch (err) {
+    if (err instanceof MissionError) {
+      return Response.json({ error: err.message }, { status: err.status })
+    }
+    throw err
+  }
+}

app/api/missions/route.ts

@@ -0,0 +1,10 @@
+import { getGameDb } from '@/lib/db/client'
+import { ensureSave } from '@/lib/game/save'
+import { getMissions } from '@/lib/game/missions'
+
+// The full mission board for the single active save; auto-initializes on first hit.
+export async function GET() {
+  const db = await getGameDb()
+  await ensureSave(db) // top-up inside getMissions assumes a save exists
+  return Response.json(await getMissions(db))
+}