Polish KarlDNS production UI and docs

tests/test_api.py

@@ -46,6 +46,9 @@ def test_api_docs_include_versioned_ddns_api(tmp_path: Path) -> None:
 
     assert docs.status_code == 200
     assert redoc.status_code == 200
+    assert docs.headers["x-robots-tag"] == "noindex, nofollow"
+    assert redoc.headers["x-robots-tag"] == "noindex, nofollow"
+    assert client.get("/openapi.json").headers["x-robots-tag"] == "noindex, nofollow"
     assert "unsafe-inline" in docs.headers["content-security-policy"]
     assert "fonts.googleapis.com" in redoc.headers["content-security-policy"]
     assert "fonts.gstatic.com" in redoc.headers["content-security-policy"]
@@ -181,6 +184,7 @@ def test_api_magic_hostname_lifecycle(tmp_path: Path) -> None:
     created = client.post("/api/v1/hostnames/magic", json={"username": "router"})
     assert created.status_code == 201
     assert created.headers["cache-control"] == "no-store"
+    assert created.headers["x-robots-tag"] == "noindex, nofollow"
     body = created.json()
     assert body["hostname"].endswith(".ddns.example.net")
     assert body["update_url"].startswith("http://ddns.example.net/u/")