Add GET /system/types: dynamic list of every creatable object type

[tomchop]

Summary

• Fixes Add API endpoint that returns available object types #1254 and the root cause of Observable type availablility #1260. Observable/entity/indicator types are each defined via a static TYPE_MAPPING registry (core/schemas/{observable,entity,indicator}.py), which a CI test (tests/schemas/registry.py) already guarantees is complete relative to what's actually on disk -- but the frontend maintains its own hand-written, independently-drifting type list per family, which is exactly what let ja3/jarm/mutex/named_pipe/package silently go missing from the "New Observable" dropdown despite being fully supported.
• New GET /system/types derives its response directly from each family's TYPE_MAPPING (plus DFIQ's, for shape parity with the paired frontend PR) instead of hand-listing types a third time, so it can't drift the same way, and automatically includes plugin-registered private/custom types (core/schemas/loader.py's load_private_types) for free -- directly answers the "how would you handle custom observables?" question raised in Add API endpoint that returns available object types #1254's linked discussion.
• Labels are hardcoded to match the frontend's existing display strings exactly (cross-checked against src/definitions/*.ts) for every already-known type, falling back to a formatted version of the type string (type.replace(...).title()) for anything new -- verified this fallback produces sensible output for the two entity types the frontend doesn't currently expose at all (note, phone).
• Requires auth (matches /workers, not /config -- this isn't needed pre-login).

Paired with yeti-feeds-frontend#304, which already expects exactly this endpoint and response shape ({observables, entities, indicators, dfiq}, each a list of {type, label}).

Test plan

• New tests in tests/apiv2/system.py: response shape, all 5 previously-missing observable types present, base-type aliases (observable/observables/dfiq) don't leak into entries, indicator set matches exactly, every entry has a non-empty label, 401 without auth
• Full tests/apiv2/system.py + tests/schemas/observable.py + tests/schemas/entity.py + tests/schemas/indicator.py + tests/apiv2/dfiq.py -- 127/127 pass
• ruff check/format --check clean; ty check clean (fixed one real finding: dict's invariant value type rejected passing dict[str, type[Observable]] where dict[str, type] was declared -- switched to collections.abc.Mapping, which is covariant)
• End-to-end: stood up this branch as a real server, checked out yeti-feeds-frontend#304 against it, logged in through the actual UI, opened "New Observable" -- all 33 types render including JA3/Mutex/etc. that Observable type availablility #1260 reported missing, zero console errors