Restrict upgrade-status endpoint to authenticated root team members

- Add auth:sanctum middleware to /api/upgrade-status route
- Check user belongs to root team (id 0) before returning status
- Return 403 if user is not authorized
- Update frontend to send credentials with fetch request
- Update OpenAPI docs with 401/403 responses

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

routes/api.php

@@ -19,11 +19,21 @@ use App\Models\Server;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/health', [OtherController::class, 'healthcheck']);
-Route::get('/upgrade-status', [OtherController::class, 'upgradeStatus']);
 Route::group([
     'prefix' => 'v1',
 ], function () {
     Route::get('/health', [OtherController::class, 'healthcheck']);
+});
+
+Route::group([
+    'middleware' => ['auth:sanctum'],
+], function () {
+    Route::get('/upgrade-status', [OtherController::class, 'upgradeStatus']);
+});
+Route::group([
+    'middleware' => ['auth:sanctum'],
+    'prefix' => 'v1',
+], function () {
     Route::get('/upgrade-status', [OtherController::class, 'upgradeStatus']);
 });