feat(api): require POST for state-changing endpoints

Make start/stop/restart, deploy, enable/disable, and server validate
POST-only, with GET returning 405. Server validate accepts optional
install and uses ValidateAndInstallServerJob. Update OpenAPI and tests.

tests/Unit/ServerValidationOpenApiTest.php

@@ -0,0 +1,19 @@
+<?php
+
+it('documents optional installation during server validation', function () {
+    $openApi = json_decode(
+        file_get_contents(__DIR__.'/../../openapi.json'),
+        true,
+        flags: JSON_THROW_ON_ERROR,
+    );
+
+    $operation = $openApi['paths']['/servers/{uuid}/validate']['post'];
+    $install = $operation['requestBody']['content']['application/json']['schema']['properties']['install'];
+
+    expect($install)
+        ->toMatchArray([
+            'type' => 'boolean',
+            'default' => false,
+        ])
+        ->and($install['description'])->toContain('restart the Docker daemon');
+});