Add per-key OpenAPI document and Swagger UI portal

GET /openapi.json (X-API-Key authenticated) merges the upstream OpenAPI
documents into one spec scoped to the calling key: only granted
operations, paths rewritten to gateway routes, component schemas
namespaced per service. GET /docs serves a Swagger UI portal that loads
the key-scoped spec and injects the key into try-it-out requests.

Discovery now caches the raw upstream spec documents (same 5-minute
TTL), and FastAPI's built-in /docs and /openapi.json are disabled in
favor of the portal routes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -33,6 +33,11 @@ with a built-in web management console.
   codes, latency by service, top keys — filterable by time range (1 h – 30 d),
   service, user and key.
 
+- **Consumer docs** — `GET /openapi.json` (authenticated with `X-API-Key`)
+  returns a merged OpenAPI document scoped to that key: every operation the
+  key holds a grant on, across all services, rewritten to the gateway's
+  routes. `GET /docs` serves a Swagger UI portal around it — paste a key,
+  browse and try exactly what that key can call.
 - **Retention** — a background purge runs every 6 hours: request/response
   payloads are blanked after 7 days (the log row stays inspectable), whole log
   rows are deleted after 90 days, and freed pages are returned to the