Enrol over http only to loopback; serve the API docs to this machine

The enrolment exemption covered any *.local host, which mDNS answers with
whoever claims it; it is now localhost, 127.0.0.0/8 and ::1. /docs, /redoc
and openapi.json stay closed in production and otherwise answer only a
loopback caller unless API_DOCS_ENABLED is set, which the dev compose does,
so `fluksio serve --host 0.0.0.0` no longer hands the schema to the network.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/tests/api/routes/test_docs.py

@@ -0,0 +1,29 @@
+"""The interactive schema: for this machine, or whoever API_DOCS_ENABLED names."""
+
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+
+from fluksio.core.config import settings
+from fluksio.main import app
+
+SCHEMA = f"{settings.API_V1_STR}/openapi.json"
+
+
+def test_the_schema_is_served_only_on_this_machine_by_default(
+    client: TestClient,
+) -> None:
+    """`fluksio serve --host 0.0.0.0` keeps ENVIRONMENT=local, and the network."""
+    for path in (SCHEMA, "/docs", "/redoc"):
+        assert client.get(path).status_code == 404  # "testclient" is not loopback
+
+    here = TestClient(app, client=("127.0.0.1", 50000))
+    assert here.get(SCHEMA).status_code == 200
+    assert here.get("/docs").status_code == 200
+
+    # Through a proxy on this machine, the caller is what counts.
+    forwarded = {"x-forwarded-for": "203.0.113.7"}
+    assert here.get(SCHEMA, headers=forwarded).status_code == 404
+
+    with patch("fluksio.core.config.settings.API_DOCS_ENABLED", True):
+        assert client.get(SCHEMA).status_code == 200