[Fix] [Docs]: Exclude Unavailable Routes from API Reference (#1550)

### Summary of Changes
Some routes were made visible that aren't actually accessible.
We fix that


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Hide internal `/internal/*` routes from the generated API reference so
docs only show endpoints that are actually accessible. Aligns the docs
with the requirement to hide internal API routes.

- **Bug Fixes**
- Added an explicit filter in `parseOpenAPI` to exclude `/internal`
paths for all audiences.
- Regenerated `docs-mintlify/openapi/{admin,client,server}.json` to
remove internal endpoints.
  - No runtime/API changes; docs only.

<sup>Written for commit c7b356a9b1.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/hexclave/hexclave/pull/1550?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added OAuth authentication endpoints for provider authorization and
token exchange.
* Expanded OAuth provider management with updated schema and additional
configuration options.

* **Bug Fixes**
  * Internal endpoints no longer appear in public API documentation.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: aman <aman@stack-auth.com>

apps/backend/src/lib/openapi.tsx

@@ -8,6 +8,10 @@ import { typedEntries, typedFromEntries } from '@hexclave/shared/dist/utils/obje
 import { deindent, stringCompare } from '@hexclave/shared/dist/utils/strings';
 import * as yup from 'yup';
 
+function isInternalApiPath(path: string) {
+  return path === '/internal' || path.startsWith('/internal/');
+}
+
 export function parseOpenAPI(options: {
   endpoints: Map<string, Map<HttpMethod, SmartRouteHandler>>,
   audience: 'client' | 'server' | 'admin',
@@ -25,6 +29,11 @@ export function parseOpenAPI(options: {
     }],
     paths: Object.fromEntries(
       [...options.endpoints]
+        // `/internal/*` routes are scoped to the internal Hexclave project (project.id === "internal")
+        // and are not part of the public API. Many of them use a permissive auth.type (e.g. adaptSchema),
+        // so the per-audience heuristic below does not exclude them; filter them out explicitly here so
+        // they never leak into the public API reference, regardless of their individual route metadata.
+        .filter(([path]) => !isInternalApiPath(path))
         .map(([path, handlersByMethod]) => (
           [path, Object.fromEntries(
             [...handlersByMethod]