Disable Swagger/ReDoc/OpenAPI JSON by default (B-42)

They enumerate the entire API surface, admin endpoints included, to
anyone who requests them. Gate them behind a new ENABLE_API_DOCS
setting (off by default) and update README/docs and BUGS.md/CLAUDE.md
open-bug counts accordingly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/unit/test_docs_disabled.py

@@ -0,0 +1,28 @@
+"""B-42: Swagger/ReDoc/OpenAPI JSON must not be reachable unless explicitly enabled —
+they enumerate the whole API surface, admin endpoints included."""
+
+import importlib
+
+from app.config import settings
+
+
+def _reload_main():
+    import app.main
+
+    return importlib.reload(app.main)
+
+
+def test_docs_disabled_by_default(monkeypatch):
+    monkeypatch.setattr(settings, "enable_api_docs", False)
+    main = _reload_main()
+    assert main.app.docs_url is None
+    assert main.app.redoc_url is None
+    assert main.app.openapi_url is None
+
+
+def test_docs_enabled_when_configured(monkeypatch):
+    monkeypatch.setattr(settings, "enable_api_docs", True)
+    main = _reload_main()
+    assert main.app.docs_url == "/docs"
+    assert main.app.redoc_url == "/redoc"
+    assert main.app.openapi_url == "/openapi.json"