refactor(openapi)!: make documentation endpoints explicit

[Kilerd]

Enabling the openapi feature previously mounted /openapi.json, /redoc, and /scalar after business middleware, so those endpoints could bypass authentication. with_openapi() had no effect, and exporting the assembled document required an HTTP request.

Documentation endpoints are now disabled by default. with_openapi() explicitly enables the standard paths; OpenApiEndpoints configures the JSON path and optional UI paths through the builder or GotchaApp::openapi_endpoints. Endpoint settings belong to the application, and both UIs load the configured JSON URL. Invalid or duplicate endpoint paths fail assembly; conflicts with business routes follow Axum's existing behavior.

Both APIs use one assembly pipeline: business routes, optional documentation, then application middleware. Builder app_layer and trait finish_router cover documentation and fallback routes as well as business routes. Existing layer behavior remains scoped to routes already registered. Application layers are installed once, in Axum order, with the last registered layer receiving requests first.

Gotcha::into_openapi, GotchaRouter::into_openapi, and GotchaApp::openapi_document expose the complete document without loading configuration, initializing state, binding a listener, or registering tasks. Export and HTTP serving share schema generation and the existing FnOnce transform pipeline. When neither export nor HTTP documentation is requested, no document is generated and transforms do not run.

Migration: applications that previously relied on the feature alone must explicitly enable endpoints. Existing with_openapi() calls now do so. Move authentication to app_layer / finish_router when it must also protect documentation. The migration guide covers custom paths, disabled UIs, middleware order, and custom build_router overrides. Existing documentation tests and examples now opt in; the OpenAPI example adds --export-openapi. Remove the now-unused direct cfg-if dependency.

Validation:

• Seven assembly tests cover both adapters, disabled/default/custom endpoints, UI URLs and escaping, middleware scope/order/fallback coverage, invalid configuration, export/HTTP byte equality, one-shot transforms, and export without a runtime or initialization. One unit test covers endpoint path validation.
• cargo test -p gotcha and cargo test -p gotcha --all-features, including existing schema, response-contract, transform, startup, and doctest coverage.
• Workspace all-features and gotcha default checks; workspace all-features Clippy with -D warnings; formatting and diff checks.
• RUSTDOCFLAGS='-D warnings' cargo doc -p gotcha --all-features --no-deps.
• Built and ran the OpenAPI example's export command with an invalid configuration file present: it exited successfully with 7 paths and 5 component schemas, without starting the application.

All 11 GitHub CI checks passed for 4b25e914e3abba446bd6dcd77898e9c757570c5c.

Closes #88.
Closes #77.