style(auth): put hasValidWebviewCapability's JSDoc back above it

The html-view helper had been inserted between the web-tab function's
JSDoc and the function, so that doc block described the wrong function.
The helper now sits after hasValidWebviewCapability with its own doc.
No behaviour change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/web/middleware/auth.ts

@@ -150,18 +150,6 @@ function isPasswordChangeExempt(req: FastifyRequest): boolean {
  * match the prefix at all. The Host allowlist is NOT bypassed, so DNS-rebinding
  * protection still applies to these requests.
  */
-/**
- * Whether a request is a GET for a rendered HTML file (`/html-view/<cap>/...`) with
- * a live capability. Same reasoning as the web-tab proxy: the page is sandboxed into
- * an opaque origin, so its asset requests carry no session cookie. Read-only by
- * construction (safe methods only), and the Host allowlist still applies.
- */
-function hasValidHtmlViewCapability(req: FastifyRequest): boolean {
-  if (req.method !== 'GET' && req.method !== 'HEAD') return false;
-  const cap = capabilityFromHtmlViewPath((req.url ?? '').split('?')[0]);
-  return !!cap && htmlViewCapabilities.resolve(cap) !== undefined;
-}
-
 function hasValidWebviewCapability(req: FastifyRequest, basePath = ''): boolean {
   // req.url is already base-stripped by the server's rewriteUrl, so the path form
   // needs no base; the Referer form below is browser-supplied and does.
@@ -196,6 +184,18 @@ function hasValidWebviewCapability(req: FastifyRequest, basePath = ''): boolean
   return !!fromReferer && webviewCapabilities.resolve(fromReferer) !== undefined;
 }
 
+/**
+ * Whether a request is a GET for a rendered HTML file (`/html-view/<cap>/...`) with
+ * a live capability. Same reasoning as the web-tab proxy: the page is sandboxed into
+ * an opaque origin, so its asset requests carry no session cookie. Read-only by
+ * construction (safe methods only), and the Host allowlist still applies.
+ */
+function hasValidHtmlViewCapability(req: FastifyRequest): boolean {
+  if (req.method !== 'GET' && req.method !== 'HEAD') return false;
+  const cap = capabilityFromHtmlViewPath((req.url ?? '').split('?')[0]);
+  return !!cap && htmlViewCapabilities.resolve(cap) !== undefined;
+}
+
 /**
  * A web-tab frame that navigated itself off the proxy prefix (see
  * isLostWebviewFrameNavigation). It cannot authenticate: opaque origin, no cookie,