fix(api): accept an existing tag UUID in the watch tag field, and deprecate it (#4361)

`tag` on POST /watch was documented as taking a tag UUID, but the value went to
add_tag(title): a UUID silently created a junk tag *titled* with that UUID and never
applied the tag the caller asked for. `tags` (UUIDs) was the only thing that worked.

- `tag=` now resolves an existing tag UUID to that tag, still falling back to title
  matching/creation for names. A UUID-shaped value matching nothing is skipped with a
  warning rather than becoming a group named after a UUID.
- Blank tokens ("One,,Two,") no longer store False in watch['tags'] - add_tag() returns
  False for an empty title and it was appended unguarded. Consumers tolerate it
  (get_all_tags_for_watch() dictfilt()s over known tags) but it is not valid data.
- add_tag()'s title search is extracted to tag_uuid_for_title(), so existence can be
  tested without creating as a side effect. add_tag()'s contract is unchanged.
- api-spec: `tag` is marked `deprecated: true` (so Redoc renders the badge) and states
  plainly that it takes names, not UUIDs. `tags` now says what it really does - applied
  verbatim, never creates, unknown UUIDs stored as dangling refs. Rendered docs rebuilt.

Every claim in the new field docs is asserted in test_api_tags.py against the real API.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/api-spec.yaml

@@ -299,13 +299,24 @@ components:
           maxLength: 5000
         tag:
           type: string
-          description: Tag UUID to associate with this web page change monitor (watch)
+          deprecated: true
+          description: |
+            **Deprecated - use `tags` instead.** Kept working for API v1 and may be removed in v2.
+
+            Takes comma-separated tag *names* (not UUIDs, despite what earlier revisions of this
+            document said). Names are matched case-insensitively against existing tags and created
+            when they don't exist yet. An existing tag's UUID is also accepted and resolves to that
+            tag; a UUID matching no tag is ignored.
           maxLength: 5000
+          example: "Production, Price tracking"
         tags:
           type: array
           items:
             type: string
-          description: Array of tag UUIDs
+          description: |
+            Array of tag UUIDs. Unlike `tag`, these are applied exactly as given - no tag is ever
+            created from this field. The UUIDs are not validated: an unknown one is stored but
+            resolves to no group.
         paused:
           type: boolean
           description: Whether the web page change monitor (watch) is paused