Remove the Swagger try-it page

It shipped 1.77 MB of vendored assets to every site - swagger-ui-bundle.min.js
alone is larger than Redoc - in order to provide an Execute button that only the
development config ever enabled. Production config had it off, testing had it
off hard, and when off the routes were never bound at all. The staticdocs
directory drops from 2.9 MB to 1.1 MB, and there is one fewer vendored
dependency to track for licences and advisories.

What replaces it: an agent has the MCP server's shopdb_call, and a human has
Redoc for reading plus the 324 harvested examples in the spec for a curl that is
mostly copy-paste. The read-only page was always the one that mattered.

The tests this leaves behind are the interesting part. That file was named for
try-it but half of it proved things about the page that stays, above all that
nothing it loads comes from the internet, which is what a CDN reference costs on
an air-gapped box. Those are kept and the file is renamed for what it covers.

Pointing the air-gap test at redoc.standalone.js immediately failed: the bundle
still carried a trailing sourceMappingURL for a .map that was never vendored,
so every devtools open was a guaranteed 404 with no internet to fall back on.
That was visible in a browser console and nobody had chased it, because the test
had only ever been parametrised over the two Swagger files. The pragma is gone
and the assertion now checks the TRAILING pragma specifically: Redoc's own code
contains that string three more times, in a data: URI it assembles and in a
worker blob, and a blunt "not in body" assertion fails on correct code.

A first attempt to strip it with a line-anchored pattern removed 507 KB, because
the bundle is minified onto long lines. Hence the anchored, byte-exact removal
and the assertion that can tell a directive from source.

(cherry picked from commit 581baafee0)

shopdb/config.py

@@ -185,21 +185,6 @@ class Config:
     AUTH_RATELIMIT_WINDOW_SECONDS = int(
         os.environ.get('AUTH_RATELIMIT_WINDOW_SECONDS', 300))
 
-    # Swagger UI "try it" page at /api/docs/try, beside the read-only Redoc
-    # page at /api/docs. One spec, two renderers.
-    #
-    # Off unless a site turns it on, and that is the point rather than caution:
-    # Swagger UI's Execute button fires a REAL request at THIS server from the
-    # operator's browser, carrying whatever session that browser already holds.
-    # On a production box that is a one-click way to POST against live fleet
-    # data from a page anyone can open. Redoc, which cannot send anything, stays
-    # the default and is always on.
-    #
-    # When off the routes are never bound at all, so /api/docs/try is Flask's
-    # own 404 and the Redoc page does not mention it. See
-    # shopdb/core/api/docs.py.
-    API_DOCS_TRYIT_ENABLED = os.environ.get(
-        'API_DOCS_TRYIT_ENABLED', 'false').lower() == 'true'
 
     DEFAULT_PAGE_SIZE = 20
     MAX_PAGE_SIZE = 100
@@ -233,8 +218,6 @@ class DevelopmentConfig(Config):
     # On in development: firing the request is the whole reason a developer
     # opens the API docs. Still read from the environment, so a shared dev
     # instance can turn it back off without editing this file.
-    API_DOCS_TRYIT_ENABLED = os.environ.get(
-        'API_DOCS_TRYIT_ENABLED', 'true').lower() == 'true'
 
     SQLALCHEMY_DATABASE_URI = os.environ.get(
         'DATABASE_URL',
@@ -265,7 +248,6 @@ class TestingConfig(Config):
     # keeps describing what production actually exposes; the tests that ARE
     # about the page build their own app with the flag on
     # (tests/test_core/test_api_docs_tryit.py).
-    API_DOCS_TRYIT_ENABLED = False
     SQLALCHEMY_DATABASE_URI = 'sqlite:///:memory:'
     SQLALCHEMY_ENGINE_OPTIONS = {
         'connect_args': {'check_same_thread': False},