feat(api): require POST for state-changing endpoints

Make start/stop/restart, deploy, enable/disable, and server validate
POST-only, with GET returning 405. Server validate accepts optional
install and uses ValidateAndInstallServerJob. Update OpenAPI and tests.

app/Http/Controllers/Api/DeployController.php

@@ -304,9 +304,9 @@ class DeployController extends Controller
         }
     }
 
-    #[OA\Get(
+    #[OA\Post(
         summary: 'Deploy',
-        description: 'Deploy by tag or uuid. `Post` request also accepted with `uuid` and `tag` json body.',
+        description: 'Deploy by tag or UUID using query parameters or a JSON body.',
         path: '/deploy',
         operationId: 'deploy-by-tag-or-uuid',
         security: [