feat(api): require POST for state-changing endpoints

Make start/stop/restart, deploy, enable/disable, and server validate
POST-only, with GET returning 405. Server validate accepts optional
install and uses ValidateAndInstallServerJob. Update OpenAPI and tests.

tests/Feature/Security/AuditLogTest.php

@@ -397,7 +397,7 @@ describe('API mutation audit logging', function () {
 
         $response = $this->withHeaders([
             'Authorization' => 'Bearer '.$token,
-        ])->getJson('/api/v1/enable');
+        ])->postJson('/api/v1/enable');
 
         $response->assertStatus(403);
     });