Swagger UI exposed without auth

[Junman140]

src/index.ts: app.use('/api-docs', swaggerUi.serve, …) is mounted without API-key middleware, so the full OpenAPI surface is available for unauthenticated reconnaissance.