feat: add favicon.ico and gate model write APIs by env flag

- Generate and serve real /favicon.ico from static assets
- Update HTML to use /favicon.ico
- Add ENABLE_MODEL_RW_API setting (default: false)
- Disable POST/DELETE model endpoints by default
- Hide write endpoints from OpenAPI when disabled
- Return 404 for write endpoints when disabled
- Update env.example with ENABLE_MODEL_RW_API documentation
- Update README and PRD with R/W API policy and remote compose notes
- Add tests to verify write endpoints are disabled by default

tests/test_api.py

@@ -92,3 +92,13 @@ def test_openapi_schema(client):
     assert "paths" in schema
     assert "/api/v1/health" in schema["paths"]
     assert "/api/v1/models" in schema["paths"]
+    assert "/api/v1/models/{model_name}/pull" not in schema["paths"]
+
+
+def test_write_endpoints_disabled_by_default(client):
+    """POST/DELETE sui modelli devono essere non disponibili di default."""
+    response_pull = client.post("/api/v1/models/llama2/pull")
+    assert response_pull.status_code == 404
+
+    response_delete = client.delete("/api/v1/models/llama2")
+    assert response_delete.status_code == 404