fix(web-api): public HITL form endpoints accept console/backstage recipient tokens

## Dify version
main (latest)

## Cloud or Self Hosted
Self Hosted (Source)

## Steps to reproduce
1. Create a workflow with a Human Input node configured for console or backstage approval.
2. Obtain the HITL form access token for that recipient type.
3. Call the unauthenticated web app endpoints with that token:
- `GET /api/form/human_input/`
- `POST /api/form/human_input/`
- `POST /api/form/human_input//upload-token`
4. The endpoints return the form definition and accept submissions.

The service API, OpenAPI, and console HITL endpoints already reject these tokens with 404. The web endpoints do not.

There is a maintainer TODO in `api/controllers/web/human_input_form.py` noting that console-only tokens should be forbidden on this surface. Unit tests (`test_get_form_allows_backstage_token`, `test_submit_form_accepts_backstage_token`) currently assert this permissive behavior.

## Expected Behavior
Public web HITL endpoints should accept only `RecipientType.STANDALONE_WEB_APP` tokens, consistent with the service API and OpenAPI surfaces. Console and backstage tokens should return 404 (Form not found).

## Actual Behavior
Console and backstage recipient tokens can be fetched and submitted through the unauthenticated web app HITL endpoints.

## Proposed fix
Add a `HumanInputSurface.WEB` entry to `ALLOWED_RECIPIENT_TYPES_BY_SURFACE` (same allowed set as service API/OpenAPI) and enforce it in the web HITL controllers after `get_form_by_token`.

Start in api/controllers/web/human_input_form.py and inspect the existing HumanInputSurface checks after get_form_by_token. Review test_get_form_allows_backstage_token and test_submit_form_accepts_backstage_token, then verify that console and backstage tokens return 404 while standalone web app tokens continue to work across GET, POST, and upload-token endpoints.

Written by the indexing model from the issue text.