Add an app-level version gate on /openapi/v1 that reads the difyctl version
from the User-Agent and returns 426 Upgrade Required (with an upgrade hint)
when the client is older than MIN_DIFYCTL_VERSION (0.2.0).
Registered via before_app_request so it also fires for requests to removed
paths — those no longer match a route and would otherwise 404 before a
blueprint-scoped hook runs. Allowlists _version/_health and fails open for
non-difyctl or unparseable User-Agents.
