#3134 Docs: serve restricted-model-types matches any @ spelling; restriction warnings in serve and check-config

What changed (swamp-club#3129)

• --restricted-model-types / auth.restricted-model-types now matches a type in any spelling: a leading @ is ignored on the list entry, on the requested type and on the stored type. Listing @acme/deploy or acme/deploy restricts the same type, for model create, method run, direct type execution and adding a workflow step. Before this, an @-prefixed extension type had to be listed in both spellings; that workaround is no longer needed.
• A restricted-model-types entry that names no type (@, ::) now stops swamp serve from starting.
• swamp serve warns at startup about a bare restricted-model-types entry that names no registered type, and about a restricted-commands entry that is not a server command. Command names match exactly.
• swamp serve check-config reports restricted-commands entries that are not server commands as warnings, and an entry that names no type as a failed check. It does not check whether a model type is registered.

Pages to update

• content/manual/reference/swamp-serve/authorization.md, the "restricted model types" section (around the --restricted-model-types 'command/shell' example): add that a leading @ is ignored when matching, give an extension-type example (@acme/deploy), and mention the startup warning.
• content/manual/reference/swamp-serve/serve-flags.md: the --restricted-model-types row says types are "normalized on parse — Command::Shell, COMMAND.SHELL, and command/shell all match". Add that a leading @ is ignored too. Add "names match exactly" to the --restricted-commands row.
• The swamp serve check-config reference, if one exists: the new restriction warnings and the failed check.