openapi: the public schema takes every route under /v1/harnesses, including console-only ones

[trifonnt]

Version: main at 51c8356. gateway/app.py, the customer-facing schema.

The route filter selects by prefix:

r.path.startswith("/v1/harnesses")

which also takes in routes the comment just above says must stay out of the public schema — the console's cloud-upload handlers (/v1/harnesses/upload, /v1/harnesses/{hid}/upload) and the kit-specific state, vendor and media handlers under the same prefix.

So a generated client treats console-internal operations as supported public API, and the schema promises a surface that is not meant to be one.

Fix shape: an explicit allowlist of the operations the public schema publishes, or a marker on the routes that belong in it, rather than a prefix match — the set of routes under /v1/harnesses grows with every console feature, and each new one joins the public schema by accident.

[richard-epsilla]

Fixed in #254, in v0.23.11: the public schema builder honours FastAPI's own marker, include_in_schema=False, and the fifteen console routes under /v1/harnesses (cloud upload, the kits' server state, vendor and media handlers) carry it at their decorators, so a new console route says what it is where it is written. Verified on the published image: 32 public paths, none of the console routes, the plugin and events routes present. Thank you.