[produckq-boop]

Summary

Closes #673

Expand end-to-end API contract and backwards-compatibility coverage in tests/contract/api-contract.test.ts (18 -> 62 tests) across versioned 2xx response envelopes, structured error contracts, security and request-correlation headers, health endpoints, and /api/* -> /api/v1/* redirection behavior:

• 2xx Versioned Response Contracts:
  • GET /api/v1/courses: verifies { success: true, data: CourseSummary[], pagination: { page, limit, total }, meta: { version, timestamp, requestId } }, ISO-8601 meta.timestamp, and Cache-Control: public, max-age=30.
  • GET /api/v1/courses/:id: verifies CourseDetail + modules array schema, ISO-8601 createdAt serialization, and meta.requestId / X-Request-Id correlation.
  • POST /api/v1/auth/challenge: verifies SEP-10 { challenge, challengeId, networkPassphrase } payload envelope and Cache-Control: no-store.
• Structured Error Contracts (400, 401, 404, 413):
  • 400: VALIDATION_ERROR with details.body on invalid request body, plus structured 400 responses on invalid querystring parameters and malformed UUID route parameters (meta omitted, Cache-Control: no-store).
  • 401 UNAUTHORIZED: unauthenticated requests and malformed Bearer tokens across protected user (/api/v1/users/me), session (/api/v1/auth/sessions), credential (/api/v1/credentials), reward (/api/v1/rewards/history), and admin (/api/v1/admin/dashboard, /admin/auth-blocks) endpoints.
  • 404 NOT_FOUND: unknown /api/v1/* routes, unknown top-level routes, and static /uploads/avatars/* path-traversal, unsupported-extension, and missing-file requests.
  • 413 PAYLOAD_TOO_LARGE: request bodies exceeding REQUEST_BODY_LIMIT_BYTES (details.expectedSize and details.actualSize).
• Headers, OpenAPI & Health Contracts:
  • X-Request-Id echo preservation across 2xx, 301 redirect, and 4xx responses plus automatic UUID-v4 generation when omitted, OWASP @fastify/helmet security headers (X-Powered-By hidden), /docs/json OpenAPI 3.x specification, and /health, /health/live, /health/ready, /health/redis, /health/database, /health/ai, and /health/stellar payload schemas.
• Backwards-Compatibility & Version Isolation:
  • 301 permanent redirects across legacy /api/* prefixes (including /api/announcements, /api/rewards/leaderboard, and /api/admin/*), deeply nested route segments with encoded query strings, POST/PUT/DELETE redirect targets resolving in a single hop without redirect loops, and strict 404 isolation on unsupported API versions (/api/v0/*, /api/v2/*, /api/v10/*).

Validation

• npx eslint tests/contract/api-contract.test.ts --max-warnings=0: passed (0 errors, 0 warnings)
• npx vitest run tests/contract/api-contract.test.ts: 62/62 tests passed