Show the API reference with Redoc

Replace the hand-built reference page with Redoc rendering the generated
OpenAPI document. The bundle is fetched by package.nix (pinned hash) and
served from the UI's own address; only that page gets a style nonce and
worker-src blob: in its CSP.

The spec now explains authentication, saved-not-applied, ETags (If-Match,
409) and errors, documents the ETag header, gives each operation a curl
sample, and no longer names MCP tools. Area GETs no longer emit
"parameters": null, which Redoc could not render.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/package.nix

@@ -1,4 +1,15 @@
-{ lib, buildGo127Module }:
+{
+  lib,
+  buildGo127Module,
+  fetchurl,
+}:
+let
+  # The API reference page is Redoc (MIT), served from the web UI's own address.
+  redoc = fetchurl {
+    url = "https://cdn.jsdelivr.net/npm/redoc@2.5.2/bundles/redoc.standalone.js";
+    hash = "sha256-a+ta6iO3HQkSLuNd6PMm44rsBQ53Tzv7ofNOXDZgiYY=";
+  };
+in
 buildGo127Module {
   pname = "router-webui";
   version = "0.1.0";
@@ -12,6 +23,11 @@ buildGo127Module {
       ./static
     ];
   };
+  # static/redoc.standalone.js is not in the source tree (git ignores it); it
+  # is embedded in the binary with the other static files.
+  preBuild = ''
+    cp ${redoc} static/redoc.standalone.js
+  '';
   # Standard library only.
   vendorHash = null;
   meta = {