feat(api): #286 — mount the whole /api surface at /api/v1

Version every /api route to /api/v1 (251 controller routes + ~24 Location
headers + the scanner callback URL + the Startup request-log literal),
uniform across the machine API, auth, scanner and scripted-build surfaces.

Add ApiVersionRewriteMiddleware: a legacy unversioned /api/* request is
rewritten (NOT redirected) to /api/v1/* in-pipeline — method, body, auth
headers and query survive — carrying RFC 8594 Deprecation/Sunset headers,
so curl / the future MCP server / bookmarks keep working. An already-
versioned path passes through; a future /api/v2 is never forced to v1.

Standardize the route convention (leading-slash absolute route per method,
no class-[Route] — except the two Scanner/Scripted controllers whose ~all
actions share a parametrized {id} prefix), enforced by ApiRouteVersioningTests
(^/api/v\d+/ over the whole Controllers.Api surface; browser-nav
/auth/oidc/login is out of scope).

Regenerate v1.json (160 paths, all /api/v1)/endpoint-index/v1.d.ts; sweep 945
SPA request literals + the test mocks (regex + positional URL parsers). /api/v1
is additive-only after freeze; the legacy-rewrite shim sunsets in ~2 releases
(owner decision) with removal tracked as a Phase-3 follow-up.

Docs: decisions.md 2026-07-13, api-conventions §1/§9, rest-api/spa-conventions/
blazor-route-parity/e2e-local/domain-model.

fixes #286
refs #197

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/api/auth.test.ts

@@ -48,7 +48,7 @@ describe('auth endpoints', () => {
     vi.restoreAllMocks();
   });
 
-  it('GET /api/auth/config', async () => {
+  it('GET /api/v1/auth/config', async () => {
     const fetchMock = vi
       .spyOn(window, 'fetch')
       .mockResolvedValue(jsonResponse({ oidcEnabled: true, localLoginEnabled: true, setupRequired: false }));
@@ -56,10 +56,10 @@ describe('auth endpoints', () => {
     const config = await getAuthConfig();
 
     expect(config).toEqual({ oidcEnabled: true, localLoginEnabled: true, setupRequired: false });
-    expect(fetchMock).toHaveBeenCalledWith('/api/auth/config', expect.objectContaining({ method: 'GET' }));
+    expect(fetchMock).toHaveBeenCalledWith('/api/v1/auth/config', expect.objectContaining({ method: 'GET' }));
   });
 
-  it('GET /api/auth/session', async () => {
+  it('GET /api/v1/auth/session', async () => {
     const fetchMock = vi
       .spyOn(window, 'fetch')
       .mockResolvedValue(jsonResponse({ authenticated: true, username: 'admin', method: 'local' }));
@@ -67,10 +67,10 @@ describe('auth endpoints', () => {
     const session = await getAuthSession();
 
     expect(session).toEqual({ authenticated: true, username: 'admin', method: 'local' });
-    expect(fetchMock).toHaveBeenCalledWith('/api/auth/session', expect.objectContaining({ method: 'GET' }));
+    expect(fetchMock).toHaveBeenCalledWith('/api/v1/auth/session', expect.objectContaining({ method: 'GET' }));
   });
 
-  it('GET /api/auth/session for an anonymous caller (username/method omitted)', async () => {
+  it('GET /api/v1/auth/session for an anonymous caller (username/method omitted)', async () => {
     // The server serializes anonymous sessions as `{ "authenticated": false }` — username/method are
     // dropped by Newtonsoft's global NullValueHandling.Ignore, so AuthSession must treat them as
     // optional/undefined rather than present-but-null.
@@ -83,7 +83,7 @@ describe('auth endpoints', () => {
     expect(session.method).toBeUndefined();
   });
 
-  it('POST /api/auth/login with credentials in the body', async () => {
+  it('POST /api/v1/auth/login with credentials in the body', async () => {
     const fetchMock = vi
       .spyOn(window, 'fetch')
       .mockResolvedValue(jsonResponse({ authenticated: true, username: 'admin', method: 'local' }));
@@ -91,7 +91,7 @@ describe('auth endpoints', () => {
     await login('admin', 'hunter2');
 
     expect(fetchMock).toHaveBeenCalledWith(
-      '/api/auth/login',
+      '/api/v1/auth/login',
       expect.objectContaining({ body: JSON.stringify({ username: 'admin', password: 'hunter2' }), method: 'POST' })
     );
   });
@@ -107,7 +107,7 @@ describe('auth endpoints', () => {
     unsubscribe();
   });
 
-  it('POST /api/auth/setup with credentials in the body', async () => {
+  it('POST /api/v1/auth/setup with credentials in the body', async () => {
     const fetchMock = vi
       .spyOn(window, 'fetch')
       .mockResolvedValue(jsonResponse({ authenticated: true, username: 'admin', method: 'local' }));
@@ -115,37 +115,37 @@ describe('auth endpoints', () => {
     await setup('admin', 'hunter2');
 
     expect(fetchMock).toHaveBeenCalledWith(
-      '/api/auth/setup',
+      '/api/v1/auth/setup',
       expect.objectContaining({ body: JSON.stringify({ username: 'admin', password: 'hunter2' }), method: 'POST' })
     );
   });
 
-  it('POST /api/auth/logout', async () => {
+  it('POST /api/v1/auth/logout', async () => {
     const fetchMock = vi.spyOn(window, 'fetch').mockResolvedValue(new Response(null, { status: 204 }));
 
     await logout();
 
-    expect(fetchMock).toHaveBeenCalledWith('/api/auth/logout', expect.objectContaining({ method: 'POST' }));
+    expect(fetchMock).toHaveBeenCalledWith('/api/v1/auth/logout', expect.objectContaining({ method: 'POST' }));
   });
 
-  it('POST /api/auth/password with both passwords, suppressing the 401 banner', async () => {
+  it('POST /api/v1/auth/password with both passwords, suppressing the 401 banner', async () => {
     const fetchMock = vi.spyOn(window, 'fetch').mockResolvedValue(new Response(null, { status: 204 }));
 
     await changePassword('old', 'new');
 
     expect(fetchMock).toHaveBeenCalledWith(
-      '/api/auth/password',
+      '/api/v1/auth/password',
       expect.objectContaining({ body: JSON.stringify({ currentPassword: 'old', newPassword: 'new' }), method: 'POST' })
     );
   });
 
-  it('GET /api/auth/machine-key', async () => {
+  it('GET /api/v1/auth/machine-key', async () => {
     const fetchMock = vi.spyOn(window, 'fetch').mockResolvedValue(jsonResponse({ apiKey: 'abc123' }));
 
     const result = await getMachineKey();
 
     expect(result).toEqual({ apiKey: 'abc123' });
-    expect(fetchMock).toHaveBeenCalledWith('/api/auth/machine-key', expect.objectContaining({ method: 'GET' }));
+    expect(fetchMock).toHaveBeenCalledWith('/api/v1/auth/machine-key', expect.objectContaining({ method: 'GET' }));
   });
 });