Add a try-it API page, and stop the docs page reaching for the internet

/api/docs renders the spec with Redoc, which is read-only by design. The thing
people mean when they ask for Swagger is firing a request from the page, so
Swagger UI now sits beside it at /api/docs/try, reading the same spec - one
contract, two renderers.

It is OFF outside development and 404s rather than rendering a disabled page: a
production box holds live fleet data, and a docs page that can POST to it is a
different object from a docs page that cannot.

Vendored, not linked. swagger-ui-bundle.min.js and swagger-ui.css are served
from staticdocs/ beside the existing Redoc bundle, because production has no
internet. validatorUrl is null: left unset, Swagger UI hands the spec to the
public swagger validator to render a badge, which here is a request that cannot
succeed and elsewhere would ship the internal API surface off the box.

THE VENDORED REDOC BUNDLE WAS ALREADY REACHING THE INTERNET, found while
proving this page does not. redoc.standalone.js fetched
cdn.redoc.ly/redoc/logo-mini.svg for the "API docs by Redocly" mark, so every
load of /api/docs on the air-gapped server has been waiting on a request that
cannot complete. Replaced with an inline transparent GIF.

Three gate holes closed, each one a dodge that worked:

- the page is built by interpolating url_for output into a JS string literal,
  unescaped. SCRIPT_NAME is proxy-controlled and ProxyFix honours
  X-Forwarded-Prefix, so a mount path carrying a quote closed the literal and
  executed what followed. The spec URL is now json.dumps'd and the rest
  HTML-escaped; the injected quote renders as \" and is inert
- the "no internet" assertion on the page scanned for https?://, so
  <script src="//cdn.jsdelivr.net/..."> - the form a copy-paste from any CDN's
  own documentation produces - matched nothing and passed
- the same assertion on the vendored files was a five-host CDN allowlist. An
  upstream bump to any other host walked through it, and the one real leak in
  that directory was on no list. It now matches the SHAPES a browser fetches -
  @import, css url(), src/href, @font-face - whatever the host, ignoring the
  data: URIs this CSS is full of

And the Redoc page's link to the try-it view is built with url_for, which raises
BuildError when those routes are not mounted - every production box. Made
unconditional it would 500 the docs page in exactly the deployment nobody tests
locally, and no test caught that. One does now.

shopdb/config.py

@@ -185,6 +185,22 @@ class Config:
     AUTH_RATELIMIT_WINDOW_SECONDS = int(
         os.environ.get('AUTH_RATELIMIT_WINDOW_SECONDS', 300))
 
+    # Swagger UI "try it" page at /api/docs/try, beside the read-only Redoc
+    # page at /api/docs. One spec, two renderers.
+    #
+    # Off unless a site turns it on, and that is the point rather than caution:
+    # Swagger UI's Execute button fires a REAL request at THIS server from the
+    # operator's browser, carrying whatever session that browser already holds.
+    # On a production box that is a one-click way to POST against live fleet
+    # data from a page anyone can open. Redoc, which cannot send anything, stays
+    # the default and is always on.
+    #
+    # When off the routes are never bound at all, so /api/docs/try is Flask's
+    # own 404 and the Redoc page does not mention it. See
+    # shopdb/core/api/docs.py.
+    API_DOCS_TRYIT_ENABLED = os.environ.get(
+        'API_DOCS_TRYIT_ENABLED', 'false').lower() == 'true'
+
     DEFAULT_PAGE_SIZE = 20
     MAX_PAGE_SIZE = 100
 
@@ -214,6 +230,12 @@ class DevelopmentConfig(Config):
     DEBUG = True
     SQLALCHEMY_ECHO = True
 
+    # On in development: firing the request is the whole reason a developer
+    # opens the API docs. Still read from the environment, so a shared dev
+    # instance can turn it back off without editing this file.
+    API_DOCS_TRYIT_ENABLED = os.environ.get(
+        'API_DOCS_TRYIT_ENABLED', 'true').lower() == 'true'
+
     SQLALCHEMY_DATABASE_URI = os.environ.get(
         'DATABASE_URL',
         'mysql+pymysql://root:changeme@127.0.0.1:3306/shopdb_flask',
@@ -234,6 +256,16 @@ class TestingConfig(Config):
     # xdist distribution, so the failure moves around. The tests that are about
     # the limiter turn it on themselves.
     ENDPOINTS_ENROLL_RATELIMIT_ENABLED = False
+    # Off, and stated here rather than inherited, because a test suite that
+    # silently ran with it on would be testing a configuration no site ships.
+    # The session-wide app in tests/conftest.py is what
+    # tests/test_core/test_public_read_surface.py sweeps for ungated GET
+    # routes, and the try-it page plus its two vendored assets are
+    # deliberately unauthenticated. Keeping the default here means that sweep
+    # keeps describing what production actually exposes; the tests that ARE
+    # about the page build their own app with the flag on
+    # (tests/test_core/test_api_docs_tryit.py).
+    API_DOCS_TRYIT_ENABLED = False
     SQLALCHEMY_DATABASE_URI = 'sqlite:///:memory:'
     SQLALCHEMY_ENGINE_OPTIONS = {
         'connect_args': {'check_same_thread': False},