feat(19.3-02): opt-in /api-docs Swagger UI page with a pinned, SRI-checked swagger-ui-dist

- surf: APIDocsProvider (one plugin) supplies a YAML or JSON OpenAPI document,
  converted once at boot to compact JSON in source key order; zero or several
  providers or a spec that does not convert fail boot
- http.api_docs.enabled/path/title mount GET /api-docs and /api-docs.json
  (summercms.apidocs, public, refusing to replace a plugin route)
- the page loads swagger-ui-dist 5.33.1 from jsDelivr with sha384 SRI and
  crossorigin on all three assets, a per-request CSP nonce for its inline
  script, nosniff and no-referrer
- docs: API documentation page section, README rows, ExampleAPIDocsProvider

modules/surf/router.go

@@ -611,6 +611,9 @@ func BuildRouter(app *backpack.App, plugins []party.Plugin) (*Router, error) {
 	if err := mountUploads(r, app); err != nil {
 		return nil, err
 	}
+	if err := mountAPIDocs(r, app, plugins); err != nil {
+		return nil, err
+	}
 	admin, err := cabana.Activate(app, plugins)
 	if err != nil {
 		return nil, err