Add an API reference page to the web UI

/apireference lists the REST operations (from the same route list and tool
schemas as the OpenAPI document) with access, parameters and a curl example
for this router. Linked from the API access page.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/templates/apiref.html

@@ -0,0 +1,35 @@
+{{define "content"}}
+{{with .Data}}
+<section class="panel">
+<h2>Using the API</h2>
+<p>Everything the MCP server offers, over plain HTTP. Base address <code>{{.Base}}</code>; the machine-readable description
+   is <a href="/api/openapi.json">/api/openapi.json</a> (OpenAPI 3.1, no token needed).</p>
+<p>Every call needs a token on the <a href="/tokens">API access</a> page, sent as <code>Authorization: Bearer rtr_…</code>.
+   A <strong>read</strong> token may use the read operations; a <strong>change</strong> token also the others. Changes to the
+   settings are saved, never applied: you review them under <a href="/changes">Changes</a> and apply them yourself.</p>
+<p>Errors are JSON, <code>{"error": "…"}</code>, with the status 400 (refused or a bad argument), 401 (no or an expired token),
+   403 (the token's access is too low), 409 (stale ETag) or 500. Results are JSON, except the pending changes and the
+   journal, which are plain text.{{if .HasOptions}} <code>GET /api/v1/options</code> lists every router option with its type,
+   default and description: what <code>settings</code> may contain.{{end}}</p>
+<p class="hint">Examples use <code>-k</code> because the certificate is self-signed unless you set up a
+   <a href="/certificate">certificate</a>; put your token in <code>$TOKEN</code>.</p>
+</section>
+<div class="cols">
+{{range .Ops}}
+<section class="panel">
+<h2><code>{{.Method}} {{.Path}}</code> <span class="muted">{{.Summary}}</span></h2>
+<p class="hint">Access: {{.Scope}}</p>
+<p>{{.Description}}</p>
+{{if .Params}}
+<div class="scroll"><table>
+  <tr><th>Parameter</th><th>Type</th><th></th><th>Description</th></tr>
+  {{range .Params}}<tr><td><code>{{.Name}}</code></td><td>{{.Type}}</td><td>{{if .Required}}required{{end}}</td><td>{{.Description}}</td></tr>{{end}}
+</table></div>
+{{end}}
+{{with .Body}}<p><strong>Body:</strong> {{.}}</p>{{end}}
+<pre class="log">{{.Curl}}</pre>
+</section>
+{{end}}
+</div>
+{{end}}
+{{end}}

pkgs/router-webui/templates/tokens.html

@@ -3,7 +3,7 @@
 <section>
 <p>An assistant or a script can read this router's state and logs and edit its settings through an
    <a href="https://modelcontextprotocol.io">MCP</a> endpoint at <code>{{.URL}}</code> and, with the same features, a
-   REST API described by <a href="/api/openapi.json">OpenAPI</a> (<code>/api/v1/…</code>). It needs a token, sent as
+   REST API described by <a href="/api/openapi.json">OpenAPI</a> (<code>/api/v1/…</code>, see the <a href="/apireference">API reference</a>). It needs a token, sent as
    <code>Authorization: Bearer …</code>. A <strong>read</strong> token reads state and settings; a <strong>change</strong>
    token can also edit the settings. Edits are saved but never applied: you review them under
    <a href="/changes">Changes</a> and apply them yourself. Secrets are never sent, and every call is logged below.</p>