docs: web-server.md is substantially stale — 10 routers and every 0.89.0 serve addition missing

[padak]

A serve audit against v0.89.0 main found docs/web-server.md badly behind the actual surface:

• Claims "150+ REST endpoints" (lines ~20/77/338); reality is 226 routes across 29 routers.
• Ten routers absent entirely: /billing, /token, /notifications, /feature, /stream, /dev-portal, /ai (ai_chat), /semantic-layer (21 routes!), /transformations, /documentation.
• SSE section names 1 of 6 live streams (missing agents.py:261/389/559, workspaces.py:197, ai_chat.py:61).
• create_app() referenced as living in server/init.py (two places); it lives in server/app.py:545.
• Every 0.89.0 serve addition is undocumented: config trash-list/restore + DELETE dry_run (fix(config): never purge on a repeated delete; add restore + trash-list (0.89.0) #643), /token routes incl. with_last_used (token create: persistent upstream 500 on POST /v2/storage/tokens surfaces as a blind retry + generic error, no actionable guidance #599/token list: no last-used signal; derivable from /v2/storage/tokens/{id}/events but no CLI path #622), /notifications (kbagent notification: fleet-wide audit of Flow Notification subscriptions (Notification Service API) #600), /billing/credits (billing: no CLI path to PAYG credit purchases and their Stripe invoice IDs; /pay-as-you-go/billing/* is session-only #594), component sync-action (fix(AI-3757): forward authorization/runtime in component sync-action #620 forwarding), describe-columns/describe-migrate, storage snapshots.
• README.md:90 calls this file "the full endpoint reference"; it is a 17-row summary table.

No OpenAPI spec is committed, so nothing in CI catches this drift — only the runtime /openapi.json. Consider either (a) generating the endpoint table from the FastAPI app in CI (mirroring the command-sync gate pattern), or (b) demoting web-server.md to an architecture doc that explicitly defers the endpoint list to /docs (Swagger) and never enumerates routes by hand.