web plugin `readonly` and `include_paths` not working?

Seems reproducible by other folks. Think this might worth raising as issue.

### Discussed in https://github.com/beetbox/beets/discussions/5290

### Problem

Running this command in verbose (`-vv`) mode:

```sh
$ beet -vv web
```

Led to this problem:

```
Can open the web ui, but cannot see / modify tags and the path
```

### Setup

* OS: Debian Linux 6.1.0-21-amd64 x86_64
* Python version: 3.12.3
* beets version: 2.0.0
* Turning off plugins made problem go away (yes/no): N/A

My configuration (output of `beet config`) is:

```yaml
directory:
# --------------- Main ---------------

library:

import:
hardlink: yes
incremental: yes
write: no

# --------------- Plugins ---------------

plugins: fetchart lastgenre spotify fromfilename duplicates web edit info mbsubmit plexupdate unimported inline mbsync

# --------------- Tagging ---------------

per_disc_numbering: yes
paths:
default: $albumartist/$album%aunique{}/%if{$multidisc,CD $disc/}$track $title
item_fields:
multidisc: 1 if disctotal > 1 else 0
disc00: u'%02i' % (disc)
spotify:
source_weight: 0.5
mode: list
tiebreak: popularity
show_failures: no
artist_field: albumartist
album_field: album
track_field: title
region_filter:
regex: []
client_id: REDACTED
client_secret: REDACTED
tokenfile: spotify_token.json
languages: en zh jp

ui:
color: yes
web:
host: 0.0.0.0
readonly: no
include_paths: yes
port: 8337
cors: ''
cors_supports_credentials: no
reverse_proxy: no
unimported:
ignore_extensions: jpg png DS_Store
ignore_subdirectories: NonMusic data temp
plex:
token: REDACTED
host: localhost
port: 32400
library_name: Music
secure: no
ignore_cert_errors: no
pathfields: {}
album_fields: {}
fetchart:
auto: yes
minwidth: 0
maxwidth: 0
quality: 0
max_filesize: 0
enforce_ratio: no
cautious: no
cover_names:
- cover
- front
- art
- album
- folder
sources:
- filesystem
- coverart
- itunes
- amazon
- albumart
- cover_art_url
store_source: no
high_resolution: no
deinterlace: no
cover_format:
google_key: REDACTED
google_engine: REDACTED
fanarttv_key: REDACTED
lastfm_key: REDACTED
duplicates:
album: no
checksum: ''
copy: ''
count: no
delete: no
format: ''
full: no
keys: []
merge: no
move: ''
path: no
tiebreak: {}
strict: no
tag: ''
mbsubmit:
format: $track. $title - $artist ($length)
threshold: medium
picard_path: picard
edit:
albumfields: album albumartist
itemfields: track title artist album
ignore_fields: id path
lastgenre:
whitelist: yes
min_weight: 10
count: 1
fallback:
canonical: no
source: album
force: yes
auto: yes
separator: ', '
prefer_specific: no
title_case: yes

```

Start by reproducing the problem with `beet -vv web` using the posted `web` configuration, especially `readonly` and `include_paths`. Trace the web plugin's handling of those settings; done means the web UI permits tag editing when `readonly: no` and displays paths when `include_paths: yes`.

Written by the indexing model from the issue text.