feat(control-panel): add interactive API docs and agent playground

[JSONbored]

Background

A control panel should let beta users explore the modern API safely. This makes Gittensory easier to understand without turning private endpoints into public docs.

Goal

Add authenticated interactive API docs and a structured agent playground for decision packs, repo intelligence, branch analysis, PR packets, and agent planning.

Current Behavior

Docs describe APIs, but users cannot safely try authenticated workflows from the web app.

Desired Behavior

Authenticated users can run controlled API examples and inspect structured responses with public/private safety notes.

Implementation Requirements

• Use only the modern canonical API contract.
• Require auth for private endpoints.
• Never point users at preview worker domains.
• Add public-safe examples for agent and PR packet workflows.
• Keep request examples source-content-free.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• Uses modern canonical API only.
• Requires auth for private endpoints.
• Does not expose preview worker URLs.
• OpenAPI examples are public-safe.
• Tests/docs checks prevent stale endpoint references.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.