Green up

Tracking docs/openapi.json (so the app can serve the spec at runtime) makes docs/ exist on the published GitHub mirror, which defeated the skipif(not DOCS.is_dir()) guard in the docs publish/version tests: they then ran against a prose-less checkout and failed on CI. Key the skip off docs/*.md prose instead, matching the canonical published-checkout definition in scripts/check-gates-ran.sh.

Also: the OpenAPI generator emitted a trailing-slash path (/api/docs/), which a strict proxy like IIS treats as a redirecting resource a subpath-mounted client cannot follow; normalise trailing slashes in _norm_path and correct the committed spec. And allow docx (python-docx) as an undeclared import: it is used only by scripts/docs/generate_docx.py, a developer tool that never runs on a deployed site.

tests/test_docs_publishable.py

@@ -28,9 +28,15 @@ DOCS = REPO / 'docs'
 # test_there_are_docs_to_check exists to catch. Distinguishing the two matters:
 # collapsing them either breaks CI on the published mirror (this module failed
 # there for exactly this reason) or quietly disables the guard everywhere.
+#
+# The test is docs/*.md PROSE, not docs/ existing. docs/openapi.json is tracked
+# so the app can serve it at runtime, which means docs/ exists even on the
+# published mirror - keying off the directory made this module run there against
+# a prose-less tree and fail. A published checkout is one with no authored
+# prose, matching the canonical definition in scripts/check-gates-ran.sh.
 pytestmark = pytest.mark.skipif(
-    not DOCS.is_dir(),
-    reason='no docs/ in this checkout - it is excluded from publication and lives in the wiki')
+    not any(DOCS.glob('*.md')),
+    reason='no docs/ prose in this checkout - it is excluded from publication and lives in the wiki')
 
 # Kept in step with the scrub list in tools/export-github.sh. Two mechanisms for
 # one rule is not ideal, but the export scrubs a tree it is about to commit while