fix(web): gate /docs, /redoc, /openapi.json behind login

FastAPI auto-registers these with no auth of its own -- every other data
route is individually wrapped in Depends(require_user), but these three
are wired up internally by the FastAPI() constructor and were never
covered by that. Confirmed live: all three returned 200 with zero session,
handing anyone who could reach the port a full map of every route --
VM remove, cache purge, template delete, service control included --
without logging in.

Disabled FastAPI's built-in docs_url/redoc_url/openapi_url and re-added all
three as ordinary routes behind the same require_user dependency every
other route uses. Verified against the live deployment: all three now 303
to /login instead of 200.

tests/python/test_web_auth.py

@@ -47,7 +47,7 @@ _OIDC_CRED_NAME = "TestWebOidcClientSecret"
 _FAKE_SESSION_SECRET = "sess-secret-do-not-leak-abc123"
 _FAKE_OIDC_CLIENT_SECRET = "oidc-client-secret-do-not-leak-xyz987"
 
-_PROTECTED_ROUTES = ["/", "/executions", "/cache", "/host"]
+_PROTECTED_ROUTES = ["/", "/executions", "/cache", "/host", "/docs", "/redoc", "/openapi.json"]
 
 
 # ── shared fixtures / fakes ─────────────────────────────────────────────────