feat(api): #286 — mount the whole /api surface at /api/v1

Version every /api route to /api/v1 (251 controller routes + ~24 Location
headers + the scanner callback URL + the Startup request-log literal),
uniform across the machine API, auth, scanner and scripted-build surfaces.

Add ApiVersionRewriteMiddleware: a legacy unversioned /api/* request is
rewritten (NOT redirected) to /api/v1/* in-pipeline — method, body, auth
headers and query survive — carrying RFC 8594 Deprecation/Sunset headers,
so curl / the future MCP server / bookmarks keep working. An already-
versioned path passes through; a future /api/v2 is never forced to v1.

Standardize the route convention (leading-slash absolute route per method,
no class-[Route] — except the two Scanner/Scripted controllers whose ~all
actions share a parametrized {id} prefix), enforced by ApiRouteVersioningTests
(^/api/v\d+/ over the whole Controllers.Api surface; browser-nav
/auth/oidc/login is out of scope).

Regenerate v1.json (160 paths, all /api/v1)/endpoint-index/v1.d.ts; sweep 945
SPA request literals + the test mocks (regex + positional URL parsers). /api/v1
is additive-only after freeze; the legacy-rewrite shim sunsets in ~2 releases
(owner decision) with removal tracked as a Phase-3 follow-up.

Docs: decisions.md 2026-07-13, api-conventions §1/§9, rest-api/spa-conventions/
blazor-route-parity/e2e-local/domain-model.

fixes #286
refs #197

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/api/multiCollections.ts

@@ -31,20 +31,20 @@ export function getMultiCollections(params: GetMultiCollectionsParams = {}): Pro
 
   const queryString = searchParams.toString();
 
-  return request<PagedMultiCollections>(`/api/multi-collections${queryString ? `?${queryString}` : ''}`);
+  return request<PagedMultiCollections>(`/api/v1/multi-collections${queryString ? `?${queryString}` : ''}`);
 }
 
 export function getMultiCollection(id: number): Promise<MultiCollection> {
-  return request<MultiCollection>(`/api/multi-collections/${id}`);
+  return request<MultiCollection>(`/api/v1/multi-collections/${id}`);
 }
 
 /** Load a single multi-collection together with its concurrency ETag (issue #253). */
 export function getMultiCollectionWithMeta(id: number): Promise<ResponseWithMeta<MultiCollection>> {
-  return requestWithMeta<MultiCollection>(`/api/multi-collections/${id}`);
+  return requestWithMeta<MultiCollection>(`/api/v1/multi-collections/${id}`);
 }
 
 export function createMultiCollection(body: CreateMultiCollectionRequest): Promise<MultiCollection> {
-  return request<MultiCollection>('/api/multi-collections', { body, method: 'POST' });
+  return request<MultiCollection>('/api/v1/multi-collections', { body, method: 'POST' });
 }
 
 /**
@@ -56,7 +56,7 @@ export function updateMultiCollection(
   body: UpdateMultiCollectionRequest,
   ifMatch?: string | null
 ): Promise<ResponseWithMeta<MultiCollection>> {
-  return requestWithMeta<MultiCollection>(`/api/multi-collections/${id}`, {
+  return requestWithMeta<MultiCollection>(`/api/v1/multi-collections/${id}`, {
     body,
     method: 'PUT',
     headers: ifMatch ? { 'If-Match': ifMatch } : undefined
@@ -64,7 +64,7 @@ export function updateMultiCollection(
 }
 
 export function deleteMultiCollection(id: number): Promise<void> {
-  return request<void>(`/api/multi-collections/${id}`, { method: 'DELETE' });
+  return request<void>(`/api/v1/multi-collections/${id}`, { method: 'DELETE' });
 }
 
 export function messageFromMultiCollectionError(