docs(15.9): correct API responses and add missing plugin, label and XPath steps

[marevol]

Summary

Correct places where the 15.9 documentation disagrees with the product, and add steps that were missing.

Changes

All seven languages, 15.9 tree only (7 files per language):

• config/search-scroll.rst: a non-GET request to /api/v2/documents/all is refused with 403 forbidden when it has no valid CSRF token, because SearchApiV2Manager checks the token before the handler runs. Only a request that has a valid token gets 405 method_not_allowed. Previously the page said 405 for everything.
• api/api-overview.rst: rate_limited is the code for the per-endpoint limits (login, password change, chat). A new note describes the server-wide rate limit (rate.limit.enabled). RateLimitFilter runs before the v2 API and does not use the v2 envelope:
  • 429 with Retry-After and {"error":"rate_limit_exceeded",...,"retry_after":60}.
  • While the address is blocked, 403 with {"error":"ip_blocked",...} and no Retry-After.
• config/rate-limiting.rst: an address blocked for exceeding the limit also gets 403, and the page now shows both response bodies.
• admin/plugin-guide.rst:
  • Describes the "Local" tab of the install page, which uploads a .jar file. The "Remote" selection must stay on its first entry, because the upload is chosen by that value.
  • The "Remote" list is read from plugin.repositories.
  • Restart after installing.
• install/fess-setup.rst: new "no Internet access" subsection. It covers:
  • downloading the ZIP and the plugin jars elsewhere;
  • placing the jars in app/WEB-INF/plugin/, or uploading them on the install page;
  • that the admin install page needs the plugin repositories to show its list.
• admin/labeltype-guide.rst: when a request comes through a virtual host, only labels with that host in their Virtual Host field are listed, so labels with an empty field are hidden (LabelTypeHelper#getLabelTypeItemList). To show a label on several hosts, create one label per host with the same value.
• config/crawler-advanced.rst, covering the crawler.document.html.*.xpath settings:
  • They apply to every web crawl.
  • With "Check Last Modified" (incremental crawling) enabled, a document whose Last-Modified is not newer than the indexed one is not fetched again, so it keeps the content extracted with the old XPath (FessCrawlerThread#isContentUpdated).
  • field.xpath.default.content (and .lang / .digest) in a web crawl config's parameters overrides them for that config (FessXpathTransformer#getContentXpath).

Checks

• python3 tools/check_headings.py on every changed file: no mismatches
• Sphinx HTML build of the 15.9 tree for each of the seven languages, before and after: no new warnings or errors, and the new fess-setup-offline label resolves