auth-service and security-audit /docs tiles broken — missing root_path, same class of bug as toolserver (now fixed)

[man4ish]

Summary

The Security Control Plane tiles for Auth Service (/_svc/auth/docs) and Security Audit (/_svc/audit/docs) render a broken Swagger-UI page — "Parser error... Unable to render this definition" — instead of the API docs.

Root cause

Both FastAPI apps are constructed without root_path:

• omnibioai-auth/app/main.py:51 — FastAPI(title="OmniBioAI Auth Service")
• omnibioai-security-audit/api/main.py:8 — FastAPI(title=f"OmniBioAI Security Audit — {AuditConfig.SERVICE_NAME}")

Behind nginx-router's prefix-stripping proxy (/_svc/auth/* → /*, /_svc/audit/* → /*), FastAPI's default /docs page requests openapi.json from the site root instead of under the prefix, so the browser gets the Studio SPA's index.html back instead of the OpenAPI spec — which Swagger-UI can't parse.

This is the same bug as the toolserver fix

omnibioai-toolserver's /_svc/toolserver/docs tile hit the identical failure and was just fixed by setting root_path="/_svc/toolserver" on its FastAPI() call (verified live: full Swagger UI now renders with all 8 operations). policy-engine and hpc-policy-engine already set root_path correctly and are unaffected — they're the reference pattern.

Fix

Same one-line change in each service, mirroring policy-engine's pattern:

• omnibioai-auth/app/main.py: FastAPI(title="OmniBioAI Auth Service", root_path="/_svc/auth")
• omnibioai-security-audit/api/main.py: add root_path="/_svc/audit" to the existing FastAPI(...) call

Open question — api-gateway

api-gateway's /_svc/gateway/docs tile could not be checked directly — its own middleware requires a Bearer token on every route (including /docs itself), so a plain browser nav returns {"error":"missing token"} before Swagger-UI ever loads. Its root_path is also unset (omnibioai-api-gateway/app/main.py:58), so it's plausibly affected by the same bug once past the auth gate — but this is unconfirmed, not assumed broken. Needs its own investigation (likely requires attaching a valid bearer token to the docs request, or checking how the Workbench tile's fetch actually authenticates).

Scope

Tracking only — not fixing auth-service or security-audit in this issue. toolserver's tile/fix already shipped.