Production banner advertises /swagger and /__dev URLs that 404 (all 4 frameworks)

[andrevanzuydam]

Summary

The framework startup banner prints Swagger: and Dashboard: URLs unconditionally,
including under tina4 serve --production and with TINA4_DEBUG=false, where both of
those endpoints correctly return 404.

Reproduction

TINA4_OVERRIDE_CLIENT=true tina4 serve --production --no-browser

Banner shows:

  Server:    http://localhost:7146 (uvicorn)
  Swagger:   http://localhost:7146/swagger
  Dashboard: http://localhost:7146/__dev
  Debug:     OFF

but:

curl -o /dev/null -w '%{http_code}\n' http://127.0.0.1:7146/__dev      # 404
curl -o /dev/null -w '%{http_code}\n' http://127.0.0.1:7146/swagger    # 404

Why it matters

It is only cosmetic, but it is actively misleading in two directions: an operator
reads it as "swagger and the dev dashboard are exposed in production" (they are not),
and a developer clicking the link gets a 404 with no explanation. It also made
verifying the dev-admin production gate harder, because the banner and the actual
behaviour disagreed.

Proposed fix (all 4, parity)

Print each line only when that surface is actually enabled: gate the Swagger: line
on the swagger predicate (is_enabled() / isEnabled() / enabled? /
swaggerEnabled()) and the Dashboard: line on the dev-admin/debug gate. When
suppressed, print nothing rather than a dead URL.

Not yet fixed.

[andrevanzuydam]

Fixed and released. The startup banner now prints the Swagger: line only when the swagger predicate is enabled, and the Dashboard: line only when the dev-admin/debug gate is on (server.py:2465-2468 in Python, parity in the other three). Under tina4 serve --production / TINA4_DEBUG=false both lines are suppressed rather than printing a dead URL.

Same fix(security): ... honest startup banner commit as the swagger static gate (python b459eb4, node 7bb5113, php 9d364ba2, ruby 803a1db), released 3.13.83, current 3.13.85.