Add hierarchical key-scoped catalog API for machine consumers

GET /catalog walks agents through progressive disclosure: available
APIs with descriptions, then one API's tags, then a tag's endpoints,
then full detail for a single operation with $refs resolved inline.
Oversized tags (tag-poor upstreams) fall back to path-prefix groups,
drillable with ?prefix= and compressed through single-child chains.

Responses are filtered to the key's grants, carry ETags for cheap
revalidation, and reuse the discovery spec cache. Key auth is shared
with the docs portal via portal.resolve_api_key; 'catalog' and 'mcp'
are now reserved slugs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -38,6 +38,12 @@ with a built-in web management console.
   key holds a grant on, across all services, rewritten to the gateway's
   routes. `GET /docs` serves a Swagger UI portal around it — paste a key,
   browse and try exactly what that key can call.
+- **Machine catalog** — a hierarchical, key-scoped catalog for agents/MCP
+  clients: `GET /catalog` (available APIs with descriptions), then
+  `/catalog/{slug}` (tags), then `/catalog/{slug}/tags/{tag}` (endpoints;
+  oversized tags group by path prefix, drill with `?prefix=`), then
+  `/catalog/{slug}/operation?method=&path=` (full schema, `$ref`s resolved
+  inline). Authenticated with `X-API-Key`; responses carry ETags.
 - **Retention** — a background purge runs every 6 hours: request/response
   payloads are blanked after 7 days (the log row stays inspectable), whole log
   rows are deleted after 90 days, and freed pages are returned to the