fix(server): gate webui-only helpers so --no-default-features builds clean

[inureyes]

Summary

Restores the OpenXLA feature compile CI job, which has failed on main since 2026-09-12 16:12 and therefore fails on every open PR. No behavior changes on any feature set.

Cause

The job's second step is cargo check --no-default-features --features xla-diagnostics --all-targets under RUSTFLAGS="-D warnings". Because default = ["surgery", "webui"], that step builds with the WebUI off.

The last success on main was 9ead2b7d (2026-09-12 04:43) and the first failure 70386ac6 (2026-09-12 16:12). The only commits between them are the WebUI series: #1857, #1860, #1865, #1868, #1864. They registered their routes behind #[cfg(feature = "webui")] but left the handlers, validators, constants, request types and imports those routes use outside the gate. With webui off all of it is dead code, and -D warnings makes each an error.

I checked before writing this that it was not already fixed elsewhere: current origin/main still carries the imports and its latest CI run still fails the job, lablup/mlxcel-internal was last pushed on 2026-09-10 and predates the breakage, and no merged or open PR fixes it.

Change

Every orphaned item is gated on webui, matching the gate its only callers already carry.

• src/server/router_server.rs: 35 handlers, validators, constants and types, plus the router_lifecycle, HeaderMap, Uri, AxumPath and RouterModelAction imports only they use.
• src/server/app.rs: six axum imports.
• src/models/mod.rs: six detection re-exports used only by server::webui. is_sequence_classification_architecture stays ungated because src/rerank/mod.rs uses it.
• src/server/auth.rs: with_extra_key, called only from the WebUI security setup in startup.rs.
• src/server/router_server_tests.rs: restore_env_var, used only by a webui-gated test.

Gating the first layer exposed a second layer of imports that only the gated items used, so this was iterated until the compiler reported nothing. The only deleted lines are import lists being split; no logic is touched.

Verification

Reproduced first on main: cargo check --no-default-features --features cuda --lib --tests reports 42 warnings in the mlxcel crate.

After the change, every cargo check below reports zero warnings and zero errors in workspace crates:

features	targets
--no-default-features --features cuda	--lib --tests
--features cuda (defaults on)	--lib --tests
--no-default-features --features cuda,webui	--lib --tests
--no-default-features --features cuda,surgery	--lib --tests
--no-default-features --features cuda	--all-targets
--features cuda (defaults on)	--all-targets

The --all-targets rows cover bins, benches and examples, where a gated item used by another target would have been a hard compile error rather than a warning. cargo fmt --all -- --check is clean.

Not built locally: the xla-iree feature itself. The OpenXLA feature compile job on this PR is the check for it, and it is the job this PR exists to turn green.

Follow-up for open PRs

PR #1872 edits src/server/router_server.rs and carries the same imports, so it will need a rebase once this lands. A rebase request will be posted there.