fix(swagger): the API doc served Swagger's demo API, not ours

[hsinatfootprintai]

swagger-ui-dist ships a swagger-initializer.js whose spec URL is Swagger's public demo API, with a comment saying the line "will be replaced by docker/configurator, when it runs in a docker-container". We embed the assets rather than running that container, so nothing ever replaced it.

So /swaggerui/ has always served somebody else's API. Found on ubm01, where it is worse than cosmetic: the site is internal-only, the browser cannot reach that host at all, and the page just renders an error.

Two things had to be right, and this process can know neither

The spec URL. An absolute path breaks under a prefix. A gateway routing /reststore/ to us rewrites the prefix away before the request arrives — by the time any Go handler sees it, the path is /swaggerui/ and the prefix is gone. The browser is the only party that still knows where the page came from, so the initializer derives the mount from window.location and asks for the spec relative to it.

The request base. The spec declares neither host nor basePath, so swagger-ui builds calls as origin + the path as written — https://host/v1/projects/… — which behind a prefix misses by exactly the prefix and 404s every Try it out. Writing a basePath into the spec would bake one deployment's layout into an artifact all of them share, so a requestInterceptor re-adds the real mount instead.

Both work unchanged whether restcol is mounted at / or at /reststore/, with no configuration.

Scope

One file overridden, not a vendored directory. The bundles and the CSS still come from the agent's embed, so there is no second copy to drift.

On the tests

They assert the failure, not the plumbing — a "200 OK" test would have passed throughout this whole bug, because the wrong file was being served perfectly well. One greps for the demo host by name, which is why the initializer's own comment must not mention it, and says so.

pkg/storage/projects fails locally without a postgres on 5432; environmental, predates this.

Downstream

grandturks' reststore imports restcol/pkg/server, so it picks this up on a go.mod bump. Tracked in FootprintAI/grandturks#1198, which also covers the remaining item: /reststore/ itself is a 404, and nobody guesses swaggerui.