Document the ten new endpoint routes and undo the stray re-indent

Two of the three things holding the wilm import out of main.

The monitor CRUD, the two resolver reads and the three operator-report routes
had no entry in docs/api-inventory.json, so test_api_inventory_parity failed.
The gate cannot run on the published mirror - the test ships but its data file
is scrubbed, and it skips on the file's absence - which is why the branch that
added the routes never saw it. Cost lands here at promotion time instead.

/api/endpoints is registered both with and without a trailing slash and both
forms are served, so both are described rather than guessing which one counts.
Spec regenerated: 353 paths, 504 operations.

plugins/endpoints/plugin.py had a contiguous run of continuation lines shifted
by one space. Python accepted it and git diff -w showed nothing, but it put
deletions in a diff that is otherwise purely additive. Restored; the file now
differs from the published main by additions only.

Scope: product

plugins/endpoints/plugin.py

@@ -167,19 +167,19 @@ class EndpointsPlugin(BasePlugin):
             # running a staged script or pushing an installer is a strictly
             # heavier grant than a routine service/process toggle.
             ('endpoints.deploy',
-               'Run staged scripts and push application installers to endpoints', 'endpoints'),
-             # Packaging the agent is a heavier grant than deploying to one, and
-             # it is not the same job either: the generated ZIP carries a live
-             # collector key stamped into its install script, so whoever holds
-             # this can mint a distributable artefact containing the fleet-wide
-             # command-channel credential. It was require_role('admin'), which
-             # this codebase otherwise reserves for the few genuinely
-             # role-shaped checks - and a role cannot be granted to one person
-             # for one job the way a permission can.
-             ('endpoints.agentpackage',
-              'Generate and download an agent or adoption-tool package '
-              '(contains a live collector key)', 'endpoints'),
-             # Collector service scope for the endpoint agent. A managed token
+             'Run staged scripts and push application installers to endpoints', 'endpoints'),
+            # Packaging the agent is a heavier grant than deploying to one, and
+            # it is not the same job either: the generated ZIP carries a live
+            # collector key stamped into its install script, so whoever holds
+            # this can mint a distributable artefact containing the fleet-wide
+            # command-channel credential. It was require_role('admin'), which
+            # this codebase otherwise reserves for the few genuinely
+            # role-shaped checks - and a role cannot be granted to one person
+            # for one job the way a permission can.
+            ('endpoints.agentpackage',
+             'Generate and download an agent or adoption-tool package '
+             '(contains a live collector key)', 'endpoints'),
+            # Collector service scope for the endpoint agent. A managed token
             # scoped to ONLY this authorizes the endpoints collector and nothing
             # else, so rotating/revoking it stops endpoint-agent traffic without
             # touching computers/geenforce collectors. Minted from the settings