fix: site name in top logo + server-list public + external API docs page

- app.js: set #logo-text (top bar) from window.__SITE_NAME__ - the
  top-right site name stayed default because only #site-title and
  #sidebar-title were set
- security.js: apiKeyGuard whitelist /api/polls/server-list so the
  ticket create page can load sub-servers (was 401 without api key)
- external-api.js: management page now only creates/manages clients,
  removed inline endpoint table
- new external-api-docs.js: full API doc page (auth flow, all 11
  endpoints, request/response examples, Node sample) at
  #/external-api-docs, linked from the management page
- index.html: load external-api-docs.js

backend/middleware/security.js

@@ -154,7 +154,7 @@ const captchaLimiter = rateLimit({
 
 function apiKeyGuard(req, res, next) {
   const p = req.originalUrl;
-  if (p === '/api/health' || p.startsWith('/api/install')) return next();
+  if (p === '/api/health' || p.startsWith('/api/install') || p.startsWith('/api/polls/server-list')) return next();
   const key = getApiKey();
   if (!key) return next();
   if (!req.headers['x-api-key'] || req.headers['x-api-key'].length !== key.length) return res.status(401).json({ error: '无效的 API 密钥' });