fix: document the required flag in openapi and pin its compat default

Review follow-ups: `PublishResourceBody` in openapi.yaml is the contract for
`/w/{workspace}/hub/resources` and the publish call goes through a raw fetch,
so nothing type-checks the drift away from the Rust struct. The setup-step
gate's comment described the pre-change behavior at the exact site reading
the changed value.

The `isRequiredResource` test pins absent-means-required, the property that
keeps every project published before the Hub stored the flag asking for all
of its resources.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MtNNB49VfeJgxAn3YNS2Cq

backend/windmill-api/openapi.yaml

@@ -35729,6 +35729,14 @@ components:
           type: string
         resource_type:
           type: string
+        required:
+          type: boolean
+          default: true
+          description: >-
+            Whether an importer has to fill this in for the project to run. False
+            for a stub minted from an item's `resource-<type>` input, which is
+            created so a standalone run has something to pick but which nothing in
+            the project reads. Omitted means true.
       required:
         - path
         - resource_type

frontend/src/lib/components/workspaceSettings/projectBundle.test.ts

@@ -16,6 +16,7 @@ import {
 	collectExportVarPaths,
 	extractTriggerConfigResourceRefs,
 	extractVarRefsFromValue,
+	isRequiredResource,
 	type ProjectExport,
 	type FetchedItem,
 	type ItemRef
@@ -867,3 +868,14 @@ describe('flow_env and preprocessor_module', () => {
 		expect(out.flow_env.PLAIN).toBe('not-a-ref')
 	})
 })
+
+describe('isRequiredResource', () => {
+	// Projects published before the Hub stored the flag carry no `required` key.
+	// Reading that as "not required" would silently stop asking for credentials
+	// every one of them genuinely needs.
+	it('treats an absent flag as required', () => {
+		expect(isRequiredResource({ path: 'f/p/db', resource_type: 'postgresql' })).toBe(true)
+		expect(isRequiredResource({ path: 'f/p/db', required: true })).toBe(true)
+		expect(isRequiredResource({ path: 'f/p/postgresql', required: false })).toBe(false)
+	})
+})

frontend/src/routes/(root)/(logged)/projects/import/+page@(root).svelte

@@ -261,9 +261,9 @@
 			setupUndecided = false
 			return
 		}
-		// Every resource the project ships arrives as an empty stub, so any project with
-		// resources has something to fill in. The step itself re-checks and shows only
-		// what is genuinely outstanding, which is what makes a re-import quiet.
+		// Every required resource arrives as an empty stub, so a project with one has
+		// something to fill in. The step itself re-checks and shows only what is
+		// genuinely outstanding, which is what makes a re-import quiet.
 		if (execution.resourceCount > 0) {
 			setupNeeded = true
 			setupUndecided = false