feat(studio): refine result feeds with signed SelectorsDocument and OpenAPI 3.1

[gildesmarais]

Summary

Token holders get a result-workspace config studio: validate / preview / suggest selectors, sign them into feed tokens, and generate via create. Flag-gated (STUDIO_ENABLED), OpenAPI 3.1 contract, SPA on #/result (no #/refine route).

This is still one large feature PR (~125 files). The four commits are review layers, not four small PRs:

1. chore(dev) — local app against published Botasaurus (make up); independent
2. feat(security) — SelectorsDocument, signed feed tokens, html2rss pin; foundation
3. feat(api) — studio endpoints, OpenAPI 3.1, operator docs; depends on 2
4. feat(frontend) — result-workspace UI + generated client; depends on 3

Also pins html2rss for selector-sample / structured validation support, and adds host-side Botasaurus compose as a small first commit.

Details

• Studio API: POST /api/v1/feeds/validate, /preview, /suggest_selectors; optional selectors on create
• Access token required; fail closed when STUDIO_ENABLED is off (URL-only create stays open)
• Preview / suggest also need AUTO_SOURCE_ENABLED (live fetch)
• Sign client selectors into feed tokens via SelectorsDocument
• Flat result editor for ready + unresolved empty-extraction; guest/no-token hides selector controls
• GET /api/v1 advertises instance.studio.enabled

Test plan

• make ci-ready in Dev Container
• Flag off: studio routes 403; URL-only create still works
• Flag on + token: suggest → edit → preview → save mints a new token
• Empty extraction with studio on opens unresolved workspace
• Guest / no token: no selector controls
• Browser smoke at http://127.0.0.1:4001/ for create → result → refine → save