[nightshift] API contract verification: security fix + validation + docs

[nightshift-micr]

Automated by Nightshift v3 (GLM 5.1).

Task: API Contract Verification
Category: pr
Changes:

Critical Security Fix

• /api/presets credential leak: The GET /api/presets endpoint was serializing the full model.Preset struct to JSON, which includes authKey, authKeyEnv, ephemeralAuthKey, ephemeralAuthKeyEnv, cleanup.apiKey, and cleanup.apiKeyEnv. These are sensitive Tailscale credentials that should never reach the browser. Introduced a presetSummary struct that only exposes non-sensitive fields (id, description, tags, acceptRoutes, allowExitNodeSelection, approvedExitNodes).

Bug Fixes

• Missing HTTP method check on /api/presets: The endpoint accepted POST, PUT, DELETE etc. — now restricted to GET only.
• Missing input validation on /api/enroll: The mode and channel fields were blindly cast to enum types without checking they are valid values. days and customDays accepted negative integers. All now validated.

Documentation

• Added comprehensive godoc comments to 36+ exported types and functions across all 6 key packages.
• Documented silent mutation contracts (state.Save, state.AppendAudit) and silent no-op behaviors (DeleteDevice, Uninstall).

All existing tests pass. Build verified clean.

Merge if useful, close if not.

[Microck]

Closing as superseded by #13. The security-sensitive parts from this PR are now merged into main, with focused tests covering preset redaction and GUI input validation.