Green up

Tracking docs/openapi.json (so the app can serve the spec at runtime) makes docs/ exist on the published GitHub mirror, which defeated the skipif(not DOCS.is_dir()) guard in the docs publish/version tests: they then ran against a prose-less checkout and failed on CI. Key the skip off docs/*.md prose instead, matching the canonical published-checkout definition in scripts/check-gates-ran.sh.

Also: the OpenAPI generator emitted a trailing-slash path (/api/docs/), which a strict proxy like IIS treats as a redirecting resource a subpath-mounted client cannot follow; normalise trailing slashes in _norm_path and correct the committed spec. And allow docx (python-docx) as an undeclared import: it is used only by scripts/docs/generate_docx.py, a developer tool that never runs on a deployed site.

tests/test_runtime_dependencies.py

@@ -38,6 +38,13 @@ ALLOWED_UNDECLARED = {
     'pip',
     'setuptools',
     'pkg_resources',
+    # python-docx, used ONLY by scripts/docs/generate_docx.py to turn local
+    # authored Markdown into DOCX deliverables in exports/. That script is a
+    # developer convenience: the app never imports it, no deployed site runs it,
+    # and the Markdown it reads is itself gitignored. Declaring it in the
+    # production requirements would ship a doc-generation library to every
+    # customer venv for no runtime purpose.
+    'docx',
 }