proto(woo): blocking setup gate; require X-Woo-* on Woo HTTP routes

Full-screen WooSetupGate on App mount when this browser lacks device WP
user + app password. Save + Test Woo dismisses only after a successful
test. Publish/test-woo auth failures reopen the gate.

Server: client_for_request requires X-Woo-* on publish, taxonomy sync,
and test-woo (401 woo_device_creds_required); health probe keeps
Settings. Optional SLAB_WOO_ALLOW_SETTINGS_FALLBACK for legacy tests.

See PROTOTYPE.md.

backend/app.py

@@ -211,6 +211,7 @@ from .woo import (
     WooAuthError,
     WooConnectionError,
     WooCredentialsMissing,
+    WooDeviceCredsRequired,
     WooError,
     WooForbiddenError,
     client_for_request,
@@ -225,11 +226,16 @@ def _woo_credentials() -> tuple[str, str | None, str | None]:
 
 @app.post("/api/v1/settings/test-woo")
 async def test_woo(request: Request) -> dict[str, Any]:
-    """Probe Woo + sync taxonomy. Optional X-Woo-Username / X-Woo-App-Password
-    override shop-default Settings for this request only (never persisted).
+    """Probe Woo + sync taxonomy. Requires X-Woo-Username / X-Woo-App-Password
+    (device creds); never reads shop-default Settings for this route.
     """
     try:
         client = client_for_request(get_connection(), request.headers)
+    except WooDeviceCredsRequired as e:
+        return JSONResponse(
+            status_code=401,
+            content=_error("woo_device_creds_required", str(e)),
+        )
     except WooCredentialsMissing as e:
         return {
             "ok": False,
@@ -262,9 +268,14 @@ async def get_taxonomy() -> dict[str, Any]:
 
 @app.post("/api/v1/admin/taxonomy/sync")
 async def post_taxonomy_sync(request: Request) -> dict[str, Any]:
-    """Refresh taxonomy cache. Honors X-Woo-* override headers for this request."""
+    """Refresh taxonomy cache. Requires X-Woo-* device headers (no Settings fallback)."""
     try:
         client = client_for_request(get_connection(), request.headers)
+    except WooDeviceCredsRequired as e:
+        return JSONResponse(
+            status_code=401,
+            content=_error("woo_device_creds_required", str(e)),
+        )
     except WooCredentialsMissing as e:
         return JSONResponse(status_code=502, content=_error("woo_unavailable", str(e)))
     try: