feat(api): add swagger ui and docx template api

เพิ่มกลุ่ม API docx template สำหรับ wordaddin (WIP):
- POST /api/template/extract ดึงค่า Content Control ทั้งหมดจาก .docx
- POST /api/template/render แทนค่า JSON ลง template คืน .docx ใหม่
- GET /api/template/test ตรวจว่า service มีชีวิต
logic แชร์ที่ app/api/template/lib-tmpl.ts (pizzip+xpath) ไม่แตะ DB

เพิ่มหน้า Swagger UI ที่ GET /api/swagger — spec inline จาก
lib/openapi.ts ครอบ API ทุกกลุ่ม (template + N10), asset self-host
ที่ public/note/swagger-ui/ จาก postinstall scripts/copy-swagger-ui.mjs
(intranet ไม่ใช้ CDN — หาไฟล์ไม่เจอหลังอัปเกรด = exit 1 เหมือน
patch-pdf-worker, Docker build รัน script นี้ด้วยผ่าน web.Dockerfile)

middleware เปิดกว้างให้ api/template, api/swagger, note/swagger-ui

จาก code review: จำกัดไฟล์แนบ 100MB ทั้ง extract/render ก่อนอ่าน
เข้าหน่วยความจำกัน DoS, คืน 400 แทน 500 เมื่อ JSON ผิด format,
sync คำอธิบาย BadRequest ใน openapi spec ให้ตรง behavior ใหม่

Co-Authored-By: Claude Code <noreply@anthropic.com>

package-lock.json

@@ -10,16 +10,20 @@
       "hasInstallScript": true,
       "dependencies": {
         "@pdf-lib/fontkit": "^1.1.1",
+        "@xmldom/xmldom": "^0.9.12",
         "drizzle-orm": "^0.45.2",
         "lucide-react": "^1.42.0",
         "next": "^14.2.35",
         "pdf-lib": "^1.17.1",
         "pdfjs-dist": "^4.10.38",
+        "pizzip": "^3.3.0",
         "pngjs": "^7.0.0",
         "postgres": "^3.4.9",
         "react": "^18.3.1",
         "react-dom": "^18.3.1",
-        "utif2": "^4.1.0"
+        "swagger-ui-dist": "^5.33.1",
+        "utif2": "^4.1.0",
+        "xpath": "^0.0.34"
       },
       "devDependencies": {
         "@types/node": "^26.5.0",
@@ -1933,6 +1937,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@scarf/scarf": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@scarf/scarf/-/scarf-1.4.0.tgz",
+      "integrity": "sha512-xxeapPiUXdZAE3che6f3xogoJPeZgig6omHEy1rIY5WVsB3H2BHNnZH+gHG6x91SCWyQCzWGsuL2Hh3ClO5/qQ==",
+      "hasInstallScript": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/@swc/counter": {
       "version": "0.1.3",
       "resolved": "https://registry.npmjs.org/@swc/counter/-/counter-0.1.3.tgz",
@@ -2061,6 +2072,15 @@
         "url": "https://opencollective.com/vitest"
       }
     },
+    "node_modules/@xmldom/xmldom": {
+      "version": "0.9.12",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz",
+      "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.6"
+      }
+    },
     "node_modules/any-promise": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
@@ -4023,6 +4043,31 @@
         "node": ">= 6"
       }
     },
+    "node_modules/pizzip": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/pizzip/-/pizzip-3.3.0.tgz",
+      "integrity": "sha512-seR2ALUYS4Z0GCs0sVwXWImhBsoCImXpHr+ExNfIZ9G0czvHqpUxlJgwHCl1BBHFyU3nUFmZJPFEEWbpY8cKRg==",
+      "license": "(MIT OR GPL-3.0)",
+      "dependencies": {
+        "pako": "^2.1.0"
+      }
+    },
+    "node_modules/pizzip/node_modules/pako": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/pako/-/pako-2.2.0.tgz",
+      "integrity": "sha512-zJq6RP/5q+TO2OpFV3FHzlPnFjmkb7Nc99a5SNjJE+uu/PkpChs+NIZSSzbBoD+6kjiISXjfYdwj1ZRQ81dz/w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "(MIT AND Zlib)"
+    },
     "node_modules/pngjs": {
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
@@ -4539,6 +4584,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/swagger-ui-dist": {
+      "version": "5.33.1",
+      "resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-5.33.1.tgz",
+      "integrity": "sha512-H872wWkA53bFIsGgi7OWgmq+CRWw3nFQGdJWRqOB9wNwTm6e5ol34+qPDkV4AJlK+gglM2EsJiOOzsGsEGbluA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@scarf/scarf": "=1.4.0"
+      }
+    },
     "node_modules/symbol-tree": {
       "version": "3.2.4",
       "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
@@ -5113,6 +5167,15 @@
       "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
       "dev": true,
       "license": "MIT"
+    },
+    "node_modules/xpath": {
+      "version": "0.0.34",
+      "resolved": "https://registry.npmjs.org/xpath/-/xpath-0.0.34.tgz",
+      "integrity": "sha512-FxF6+rkr1rNSQrhUNYrAFJpRXNzlDoMxeXN5qI84939ylEv3qqPFKa85Oxr6tDaJKqwW6KKyo2v26TSv3k6LeA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.6.0"
+      }
     }
   }
 }