feat(tenant-api): expose Swagger UI in non-release mode

Adds an in-process Swagger UI and OpenAPI JSON under /swagger,
registered automatically when the Gin mode is not release. The
admin-web Vite dev server and production nginx config now proxy
/swagger to the tenant API so the docs are reachable from the
existing admin host.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/shared/swagger/swagger_test.go

@@ -0,0 +1,59 @@
+package swagger
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildOpenAPI_GeneratesUsableSpecFromGinRoutes(t *testing.T) {
+	spec := BuildOpenAPI(gin.RoutesInfo{
+		{Method: http.MethodPost, Path: "/api/auth/login"},
+		{Method: http.MethodGet, Path: "/api/tenant/articles/:id"},
+		{Method: http.MethodPost, Path: "/api/tenant/articles/:id/images"},
+		{Method: http.MethodGet, Path: "/api/internal/metrics/monitoring"},
+		{Method: http.MethodGet, Path: "/swagger/openapi.json"},
+	}, Config{Title: "Test API", Version: "v1"})
+
+	_, err := json.Marshal(spec)
+	require.NoError(t, err)
+
+	paths := spec["paths"].(map[string]any)
+	require.Contains(t, paths, "/api/auth/login")
+	require.Contains(t, paths, "/api/tenant/articles/{id}")
+	require.Contains(t, paths, "/api/tenant/articles/{id}/images")
+	require.NotContains(t, paths, "/api/internal/metrics/monitoring")
+	require.NotContains(t, paths, "/swagger/openapi.json")
+
+	articlePath := paths["/api/tenant/articles/{id}"].(map[string]any)
+	getArticle := articlePath["get"].(map[string]any)
+	require.Equal(t, []map[string][]string{{"bearerAuth": []string{}}}, getArticle["security"])
+
+	params := getArticle["parameters"].([]map[string]any)
+	require.Contains(t, parameterNames(params), "id")
+	require.Contains(t, parameterNames(params), "X-Workspace-ID")
+
+	imagePath := paths["/api/tenant/articles/{id}/images"].(map[string]any)
+	uploadImage := imagePath["post"].(map[string]any)
+	body := uploadImage["requestBody"].(map[string]any)
+	content := body["content"].(map[string]any)
+	require.Contains(t, content, "multipart/form-data")
+}
+
+func TestEnabledForMode_DisablesReleaseOnly(t *testing.T) {
+	require.False(t, EnabledForMode("release"))
+	require.False(t, EnabledForMode(" Release "))
+	require.True(t, EnabledForMode(""))
+	require.True(t, EnabledForMode("debug"))
+}
+
+func parameterNames(params []map[string]any) []string {
+	names := make([]string, 0, len(params))
+	for _, param := range params {
+		names = append(names, param["name"].(string))
+	}
+	return names
+}