fix(openapi): respect function volatility for GET methods

The OpenAPI specification was incorrectly exposing GET methods for
VOLATILE functions, even though such functions properly reject GET
requests at runtime with "405 Method Not Allowed".  This created
a mismatch between the advertised API specification and the actual
runtime behavior.

VOLATILE functions should only be callable via POST since they may
have side effects, while STABLE and IMMUTABLE functions can safely
be called via GET since they don't modify database state.

Fix by checking the pdVolatility field in makeProcPathItem() and
only including GET methods in the OpenAPI PathItem for non-volatile
functions.

The runtime behavior was already correct; this fixes only the
OpenAPI documentation generation.

test/spec/Feature/OpenApi/OpenApiSpec.hs

@@ -1058,6 +1058,33 @@ spec = describe "OpenAPI" $ do
           }
         |]
 
+    it "only includes POST method for volatile functions" $ do
+      r <- simpleBody <$> get "/"
+      let volatileGet = r ^? key "paths" . key "/rpc/reset_table" . key "get"
+          volatilePost = r ^? key "paths" . key "/rpc/reset_table" . key "post"
+
+      liftIO $ do
+        volatileGet `shouldBe` Nothing
+        volatilePost `shouldNotBe` Nothing
+
+    it "includes GET and POST methods for stable functions" $ do
+      r <- simpleBody <$> get "/"
+      let stableGet = r ^? key "paths" . key "/rpc/getallusers" . key "get"
+          stablePost = r ^? key "paths" . key "/rpc/getallusers" . key "post"
+
+      liftIO $ do
+        stableGet `shouldNotBe` Nothing
+        stablePost `shouldNotBe` Nothing
+
+    it "includes GET and POST methods for immutable functions" $ do
+      r <- simpleBody <$> get "/"
+      let immutableGet = r ^? key "paths" . key "/rpc/jwt_test" . key "get"
+          immutablePost = r ^? key "paths" . key "/rpc/jwt_test" . key "post"
+
+      liftIO $ do
+        immutableGet `shouldNotBe` Nothing
+        immutablePost `shouldNotBe` Nothing
+
   describe "Security" $
     it "does not include security or security definitions by default" $ do
       r <- simpleBody <$> get "/"