docs(openflare): complete Swagger for protocol and dashboard APIs

Add Swagger annotations for all Agent, Relay, and Tunnel protocol
endpoints under /api/v1. Register AgentTokenAuth and TunnelTokenAuth
security definitions. Align dashboard API docs to return 404 for
insufficient admin permission.

Wavelet/internal/apps/openflare/relay/routers.go

@@ -14,6 +14,18 @@ import (
 )
 
 // PostHeartbeat handles POST /relay/heartbeat.
+// @Summary 上报 Relay 心跳
+// @Description Relay 节点定期上报运行状态与 frps 观测数据，返回运行时配置
+// @Tags openflare-relay
+// @Accept json
+// @Produce json
+// @Security AgentTokenAuth
+// @Param body body relay.HeartbeatPayload true "心跳载荷"
+// @Success 200 {object} response.Any{data=relay.HeartbeatResponse} "心跳响应"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "Agent Token 无效"
+// @Failure 403 {object} response.Any "节点类型不匹配"
+// @Router /api/v1/relay/heartbeat [post]
 func PostHeartbeat(c *gin.Context) {
 	var payload HeartbeatPayload
 	if !apiutil.BindJSON(c, &payload) {
@@ -36,6 +48,13 @@ func PostHeartbeat(c *gin.Context) {
 }
 
 // GetWebSocket handles GET /relay/ws.
+// @Summary 升级 Relay WebSocket 连接
+// @Description 将已认证的 Relay 连接升级为 WebSocket 长连接，用于配置推送
+// @Tags openflare-relay
+// @Security AgentTokenAuth
+// @Failure 401 {object} response.Any "Agent Token 无效"
+// @Failure 403 {object} response.Any "节点类型不匹配"
+// @Router /api/v1/relay/ws [get]
 func GetWebSocket(c *gin.Context) {
 	authNode, ok := c.Get(ctxRelayNodeKey)
 	if !ok {