feat: gate Swagger/OpenAPI docs endpoint in production

[birme]

Summary

• Wrap the swagger and swaggerUI (/api/docs) plugin registrations in src/api.ts behind a gate: const enableSwagger = process.env.NODE_ENV !== 'production' || process.env.ENABLE_SWAGGER === 'true'
• The API docs endpoint is no longer exposed in production unless explicitly enabled via ENABLE_SWAGGER=true, reducing the attack surface
• Add tests in src/api.test.ts covering the three behaviors: 200 by default (non-prod), 404 when NODE_ENV=production, and 200 in production when ENABLE_SWAGGER=true

Test plan

• Tests pass (npm test — 368 tests)
• TypeScript compiles (npm run typecheck)
• Lint clean (npm run lint)
• /api/docs returns 200 by default in non-production
• /api/docs returns 404 when NODE_ENV=production
• /api/docs returns 200 in production when ENABLE_SWAGGER=true

Closes #233

🤖 Generated with Claude Code

[birme]

Code Review

Verdict: LGTM

Summary: A minimal, correctly-scoped change that gates the Swagger/OpenAPI docs behind NODE_ENV !== 'production' || ENABLE_SWAGGER === 'true'. Boolean logic is correct, tests are meaningful and restore env state properly, and all CI checks pass (lint, pretty, ts, unittests). One non-blocking note.

Blocking

None.

Warnings

• src/api.ts — Fail-open default: docs are exposed whenever NODE_ENV !== 'production', so a deployment that does not set NODE_ENV=production would serve /api/docs. Mitigated because the repo Dockerfile sets ENV NODE_ENV=production; worth documenting the requirement for non-container prod deployments.

Suggestions

• Consider noting the NODE_ENV=production requirement in deploy docs / .env.sample.

Reviewed by the daily-backlog-pr code-reviewer (a separate invocation from the implementer). Posted as a marker comment because GitHub blocks state-bearing self-review when author == reviewer.