State the deny-unknown-fields rule where it governs all the bodies

It had landed appended to `SshRequest`'s doc comment, so a rule about
every request body in the module read as something about how to describe
a machine. Moved to the module doc beside the route table, where the set
it governs is what a reader is already looking at, and worded so a new
request body knows it is expected to carry the attribute too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/routes.rs

@@ -29,6 +29,16 @@
 //!
 //! Everything here works purely in the common event model; nothing may
 //! branch on the session kind (that's what drivers are for).
+//!
+//! **Every request body in this module refuses fields it does not know**
+//! (`serde(deny_unknown_fields)`), and a new one is expected to do the
+//! same. Silently ignoring a field is the worst available answer: a caller
+//! that misspells `permissionMode` got a 200 and a session running in the
+//! default permission mode, which is indistinguishable from success at the
+//! place they are looking. It cost an hour here, chasing a "startup race"
+//! that was a snake_case key serde had dropped on the floor. Query strings
+//! are deliberately left permissive -- a stale link carrying an extra
+//! parameter is not a mistake worth failing a request over.
 
 use std::convert::Infallible;
 use std::path::{Path, PathBuf};
@@ -186,16 +196,6 @@ fn info_for(setup: crate::config::SetupConfig) -> SetupInfo {
 /// Note what is absent: nothing here names a program. Providers are found
 /// by asking the machine (`crate::setups`), never sent, so the enrolled
 /// token cannot introduce something to run.
-/// Every request body below refuses fields it does not know.
-///
-/// Silently ignoring one is the worst available answer: a caller that
-/// misspells `permissionMode` gets a session in the default permission mode
-/// and a 200 saying it worked, which is indistinguishable from success at
-/// the place they are looking. It cost an hour of chasing a "race" that was
-/// a snake_case key serde had dropped on the floor. A 400 naming the field
-/// is the whole fix, and it belongs on all of them rather than on the one
-/// that bit -- query strings are deliberately excluded, since a stale link
-/// carrying an extra parameter is not a mistake worth failing.
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 #[serde(deny_unknown_fields)]