Restrict upgrade-status endpoint to authenticated root team members

- Add auth:sanctum middleware to /api/upgrade-status route
- Check user belongs to root team (id 0) before returning status
- Return 403 if user is not authorized
- Update frontend to send credentials with fetch request
- Update OpenAPI docs with 401/403 responses

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

resources/views/livewire/upgrade.blade.php

@@ -286,11 +286,17 @@
 
                 // Poll upgrade status API for real progress
                 this.checkUpgradeStatusInterval = setInterval(() => {
-                    fetch('/api/upgrade-status')
+                    fetch('/api/upgrade-status', {
+                        credentials: 'same-origin',
+                        headers: {
+                            'Accept': 'application/json',
+                        }
+                    })
                         .then(response => {
                             if (response.ok) {
                                 return response.json();
                             }
+                            // Auth errors (401/403) or service down - switch to health check
                             throw new Error('Service unavailable');
                         })
                         .then(data => {