feat(reality): warn when target cert chain is too small for ML-DSA-65 (#6470)

* feat(reality): warn when target cert chain is too small for ML-DSA-65

Expose peer cert-chain DER size from the REALITY scanner and surface a UI
warning when ML-DSA-65 is enabled but the chain is under xray-core's 3500-byte
minimum, so silent fallback failures are easier to catch.

Fixes #5973

* fix(reality): gate scanner ML-DSA tag and sync docs OpenAPI

Only warn on short cert chains in the target scanner when ML-DSA-65 is
enabled. Copy frontend/public/openapi.json to docs/public/openapi.json
and fix oxfmt wrapping in the new test.

---------

Co-authored-by: mrchatam <287639636+mrchatam@users.noreply.github.com>

internal/web/translation/en-US.json

@@ -642,6 +642,8 @@
         "scanCert": "Certificate",
         "scanCertInvalid": "Not trusted",
         "scanCertExpiry": "Certificate expires",
+        "scanCertChain": "Cert chain",
+        "scanMldsaCertChainTooSmall": "Target certificate chain is {length} bytes, which is below the {min}-byte minimum required for ML-DSA-65. This will cause silent connection failures. Please choose a different target or disable ML-DSA-65.",
         "scanSniUsed": "SNI used",
         "scanPrivateNote": "Checked over a private/local network — this address is not reachable from the internet.",
         "scanPrivateConfirmTitle": "Target on a local network",