feat(api): #286 — mount the whole /api surface at /api/v1

Version every /api route to /api/v1 (251 controller routes + ~24 Location
headers + the scanner callback URL + the Startup request-log literal),
uniform across the machine API, auth, scanner and scripted-build surfaces.

Add ApiVersionRewriteMiddleware: a legacy unversioned /api/* request is
rewritten (NOT redirected) to /api/v1/* in-pipeline — method, body, auth
headers and query survive — carrying RFC 8594 Deprecation/Sunset headers,
so curl / the future MCP server / bookmarks keep working. An already-
versioned path passes through; a future /api/v2 is never forced to v1.

Standardize the route convention (leading-slash absolute route per method,
no class-[Route] — except the two Scanner/Scripted controllers whose ~all
actions share a parametrized {id} prefix), enforced by ApiRouteVersioningTests
(^/api/v\d+/ over the whole Controllers.Api surface; browser-nav
/auth/oidc/login is out of scope).

Regenerate v1.json (160 paths, all /api/v1)/endpoint-index/v1.d.ts; sweep 945
SPA request literals + the test mocks (regex + positional URL parsers). /api/v1
is additive-only after freeze; the legacy-rewrite shim sunsets in ~2 releases
(owner decision) with removal tracked as a Phase-3 follow-up.

Docs: decisions.md 2026-07-13, api-conventions §1/§9, rest-api/spa-conventions/
blazor-route-parity/e2e-local/domain-model.

fixes #286
refs #197

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/api/multiCollections.test.ts

@@ -32,7 +32,7 @@ describe('multiCollections api client', () => {
     await getMultiCollections({ pageNum: 2, pageSize: 25, query: 'kids' });
 
     const url = new URL(String(fetchMock.mock.calls[0][0]), 'http://localhost');
-    expect(url.pathname).toBe('/api/multi-collections');
+    expect(url.pathname).toBe('/api/v1/multi-collections');
     expect(url.searchParams.get('pageNum')).toBe('2');
     expect(url.searchParams.get('pageSize')).toBe('25');
     expect(url.searchParams.get('query')).toBe('kids');
@@ -43,7 +43,7 @@ describe('multiCollections api client', () => {
 
     await getMultiCollections();
 
-    expect(fetchMock).toHaveBeenCalledWith('/api/multi-collections', expect.objectContaining({ method: 'GET' }));
+    expect(fetchMock).toHaveBeenCalledWith('/api/v1/multi-collections', expect.objectContaining({ method: 'GET' }));
   });
 
   it('getMultiCollection fetches a single multi-collection by id', async () => {
@@ -52,7 +52,7 @@ describe('multiCollections api client', () => {
       .mockResolvedValue(jsonResponse({ id: 4, items: [], name: 'Bundle' }));
 
     await expect(getMultiCollection(4)).resolves.toMatchObject({ id: 4 });
-    expect(fetchMock).toHaveBeenCalledWith('/api/multi-collections/4', expect.objectContaining({ method: 'GET' }));
+    expect(fetchMock).toHaveBeenCalledWith('/api/v1/multi-collections/4', expect.objectContaining({ method: 'GET' }));
   });
 
   it('createMultiCollection POSTs the name and items', async () => {
@@ -65,7 +65,7 @@ describe('multiCollections api client', () => {
     await expect(createMultiCollection(body)).resolves.toMatchObject({ id: 9 });
 
     const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe('/api/multi-collections');
+    expect(url).toBe('/api/v1/multi-collections');
     expect(init).toMatchObject({ method: 'POST' });
     expect(JSON.parse(String(init?.body))).toEqual(body);
   });
@@ -80,7 +80,7 @@ describe('multiCollections api client', () => {
     await updateMultiCollection(5, body);
 
     const [url, init] = fetchMock.mock.calls[0];
-    expect(url).toBe('/api/multi-collections/5');
+    expect(url).toBe('/api/v1/multi-collections/5');
     expect(init).toMatchObject({ method: 'PUT' });
     expect(JSON.parse(String(init?.body))).toEqual(body);
   });
@@ -89,7 +89,7 @@ describe('multiCollections api client', () => {
     const fetchMock = vi.spyOn(window, 'fetch').mockResolvedValue(noContent());
 
     await expect(deleteMultiCollection(6)).resolves.toBeUndefined();
-    expect(fetchMock).toHaveBeenCalledWith('/api/multi-collections/6', expect.objectContaining({ method: 'DELETE' }));
+    expect(fetchMock).toHaveBeenCalledWith('/api/v1/multi-collections/6', expect.objectContaining({ method: 'DELETE' }));
   });
 
   it('messageFromMultiCollectionError narrows ApiError, Error, and unknown', () => {