fix(http): unify model upload + status under /ml/models scope

The upload route was registered at `/api/models/upload` while the
status / dormant routes lived at `/api/ml/models/current`. Doc comments
already advertised the unified `/api/ml/models/upload` path. Move the
upload scope from `/models` to `/ml/models` so:

* the entire ML model lifecycle (status, dormant, upload) lives under
  one URL subtree, matching the doc comments;
* the RBAC scope mapping in middleware.rs (`/api/ml/` → `ai_detection`)
  now also covers upload, layered on top of the handler-level
  `users:admin` check;
* frontend clients can build the model URLs from a single base path.

Also fix the stale `GET /api/models/current` reference in
`model_source.rs` ModelSourceStatus doc comment.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

net-guardia/src/adapter/http/model_upload.rs

@@ -120,7 +120,11 @@ impl Drop for PromoteGuard<'_> {
 }
 
 pub fn initialize() -> Scope {
-    web::scope("/models").route("/upload", web::post().to(upload))
+    // Mounted under `/ml/models/upload` so the entire ML model lifecycle
+    // (status, dormant, upload) lives under one URL subtree. The peer
+    // `/ml/models/current` GET/DELETE routes live in `ml::initialize()`;
+    // actix dispatches each path to whichever scope owns it.
+    web::scope("/ml/models").route("/upload", web::post().to(upload))
 }
 
 /// `POST /api/ml/models/upload` — multipart with `manifest` (YAML text),

net-guardia/src/model/detection/model_source.rs

@@ -44,7 +44,7 @@ impl ModelInfo {
 }
 
 /// Wire-format ML source status. Broadcast to frontend; returned by
-/// `GET /api/models/current`. Serde-tagged so the frontend can discriminate
+/// `GET /api/ml/models/current`. Serde-tagged so the frontend can discriminate
 /// on the `state` field.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "state", rename_all = "snake_case")]