Close /api/health details and API docs to the public

Health: public gets only ok/error; details need X-Internal-Key. Docs/schema: admin session only.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

rag/tests_tutor_quality.py

@@ -225,6 +225,7 @@ class ConversationMemoryTests(TestCase):
 
 
 @override_settings(**RAG_ON)
+@override_settings(INTERNAL_SERVICE_KEY='k')
 class ProviderStateTests(TestCase):
     """اعتبارِ تمام‌شده باید در /api/health دیده شود، نه فقط در لاگ."""
 
@@ -247,17 +248,17 @@ class ProviderStateTests(TestCase):
         quota = RuntimeError("Error code: 403 - insufficient user quota, remaining quota: $-0.001")
         self.assertEqual(self._ask({'side_effect': quota}).status_code, 503)
 
-        health = self.client.get('/api/health').json()
+        health = self.client.get('/api/health', HTTP_X_INTERNAL_KEY='k').json()
         self.assertEqual(health['integrations']['aiProvider']['state'], 'quota_exhausted')
         self.assertTrue(any('GapGPT' in w for w in health['warnings']))
 
         self.assertEqual(self._ask({'return_value': ('جواب', [], {})}).status_code, 200)
-        health = self.client.get('/api/health').json()
+        health = self.client.get('/api/health', HTTP_X_INTERNAL_KEY='k').json()
         self.assertEqual(health['integrations']['aiProvider']['state'], 'ok')
 
     def test_an_ordinary_network_error_does_not_claim_the_credit_is_gone(self):
         self.assertEqual(self._ask({'side_effect': ConnectionError('timeout')}).status_code, 503)
-        health = self.client.get('/api/health').json()
+        health = self.client.get('/api/health', HTTP_X_INTERNAL_KEY='k').json()
         self.assertEqual(health['integrations']['aiProvider']['state'], 'ok')