[fix] stop serving the openapi document to anonymous callers

[Duansg]

What's changed?

The OpenAPI/Swagger document endpoints are no longer open to anonymous callers; scoped to admin.

Checklist

• I have read the Contributing Guide
• I have written the necessary doc or comment.
• I have added the necessary unit tests and all cases have passed.

Add or update API

• I have added the necessary e2e tests and all cases have passed.

[Duansg]

/swagger-ui/index.html is still served anonymously by the existing /**/*.html===get exclusion, but the page fetches /v3/api-docs/swagger-config and /v3/api-docs without an Authorization header — swagger-ui's Authorize button only applies to try-it-out calls, not to the spec fetch. The UI will therefore show "Failed to load API definition" for everyone, including admins.

The document itself remains reachable for an admin with a token:

curl -H "Authorization: Bearer $JWT" http://localhost:1157/v3/api-docs

If the community would rather not ship a UI page that cannot load, the follow-up is to set springdoc.api-docs.enabled / springdoc.swagger-ui.enabled to false by default and let deployments opt in; that is a product decision kept out of this PR.

[zqr10159]

Restricting the generated OpenAPI document to administrators is the right security boundary, but the current change leaves /swagger-ui/index.html publicly reachable while the UI cannot attach an administrator token to its initial /v3/api-docs/swagger-config and /v3/api-docs requests. The result is a shipped page that shows “Failed to load API definition” for anonymous users and administrators alike. Please either disable the Swagger UI by default (with an explicit opt-in deployment path), or provide an authenticated loading flow that lets an administrator use it. Keep the document endpoints admin-only in either case.