Green up

Tracking docs/openapi.json (so the app can serve the spec at runtime) makes docs/ exist on the published GitHub mirror, which defeated the skipif(not DOCS.is_dir()) guard in the docs publish/version tests: they then ran against a prose-less checkout and failed on CI. Key the skip off docs/*.md prose instead, matching the canonical published-checkout definition in scripts/check-gates-ran.sh.

Also: the OpenAPI generator emitted a trailing-slash path (/api/docs/), which a strict proxy like IIS treats as a redirecting resource a subpath-mounted client cannot follow; normalise trailing slashes in _norm_path and correct the committed spec. And allow docx (python-docx) as an undeclared import: it is used only by scripts/docs/generate_docx.py, a developer tool that never runs on a deployed site.

scripts/gen_openapi.py

@@ -59,7 +59,13 @@ def _product_version():
 
 def _norm_path(p):
     # Flask <int:id> / <id> -> OpenAPI {id}
-    return re.sub(r'<(?:[^:>]+:)?([^>]+)>', r'{\1}', p or '')
+    normalised = re.sub(r'<(?:[^:>]+:)?([^>]+)>', r'{\1}', p or '')
+    # A trailing slash in a published path is a distinct resource to a strict
+    # proxy (IIS), which answers the unslashed URL with a redirect a client
+    # behind a subpath mount cannot follow. Emit the canonical, slashless form.
+    if len(normalised) > 1:
+        normalised = normalised.rstrip('/')
+    return normalised
 
 
 def _security(auth):