docs(api): reconcile the RI-exchange approve spec (no 401 documented) with the handler comments, and stale 'authenticate' comments in router.go #600

Found in the review of PR #599 (closes #528). (1) internal/api/openapi.yaml approveRIExchange (~1320-1372) documents 400/403/404/409 and no 401, and says a request with neither token nor session gets 403 (CSRF); the handler comments at internal/api/handler_ri_exchange.go ~2180 and ~2252 mention a 401 from requireSession. Run the real path through HandleRequest (no session, no token; session without token; token without session) and make the spec and the comments match the actual behavior; #528 had asked for 401/403/409 on RI approve. (2) internal/api/router.go ~22 and ~380 comments still say 'validateSecurity -> authenticate', naming a function removed in #599; reword to 'authentication middleware'.

Acceptance: spec and comments match observed behavior with a HandleRequest test per documented code. Related: #528, #599.