Play Framework

feat: gate /@api spec endpoints behind openapi.publicSpec in PROD

The OpenAPI spec describes every route + parameter shape the app exposes.
Publishing it to anonymous callers in production is a deliberate API-
contract decision, not the default — most apps don't want their full
API surface inventoried by anyone hitting /@api/openapi.json.

- Adds openapi.publicSpec config (default false). DEV mode always serves
  the spec; PROD serves it only when publicSpec=true.
- /@api/docs (Swagger UI) remains DEV-only regardless — Swagger UI is a
  development affordance, not a production contract.
- Refactors the existing 404 helper into notFound() and reuses it for
  the new gating, deduplicating one serveDocs branch in the process.
- Short-circuits onConfigurationRead when openapi.enabled=false so
  disabled instances skip the config + route registration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>