proto(woo): blocking setup gate; require X-Woo-* on Woo HTTP routes

Full-screen WooSetupGate on App mount when this browser lacks device WP
user + app password. Save + Test Woo dismisses only after a successful
test. Publish/test-woo auth failures reopen the gate.

Server: client_for_request requires X-Woo-* on publish, taxonomy sync,
and test-woo (401 woo_device_creds_required); health probe keeps
Settings. Optional SLAB_WOO_ALLOW_SETTINGS_FALLBACK for legacy tests.

See PROTOTYPE.md.

backend/tests/test_exit_inference_off.py

@@ -21,6 +21,7 @@ def env(monkeypatch):
     os.environ["SLAB_IMAGES_DIR"] = tmp
     os.environ["WOO_BASE_URL"] = "https://store.example.com"
     os.environ["SLAB_AES_KEY"] = base64.b64encode(b"0123456789abcdef0123456789abcdef").decode()
+    os.environ["SLAB_WOO_ALLOW_SETTINGS_FALLBACK"] = "1"  # legacy tests; prefer X-Woo-* headers
     db_mod._reset_for_tests()
     from backend.crypto import encrypt