feat(api): standardize REST contracts and auth

tests/api/test_audit_endpoints.py

@@ -17,7 +17,7 @@ def _build_client(
     metadata_admin=None,
     metadata_user=None,
 ) -> TestClient:
-    app = build_test_app(audit_endpoint.router, "/audit")
+    app = build_test_app(audit_endpoint.router, "/api/v1")
     app.dependency_overrides[audit_endpoint.get_audit_repository] = lambda: repo
     if metadata_admin is not None:
         app.dependency_overrides[get_current_metadata_admin] = lambda: metadata_admin
@@ -38,7 +38,7 @@ def test_get_audit_logs_passes_filters():
     client = _build_client(repo, metadata_admin=object())
 
     response = client.get(
-        "/audit/logs",
+        "/api/v1/audit-logs",
         params={
             "action": "LOGIN",
             "resource_type": "user",
@@ -68,7 +68,7 @@ def test_get_audit_logs_count_returns_count_payload():
     )()
     client = _build_client(repo, metadata_admin=object())
 
-    response = client.get("/audit/logs/count", params={"action": "DELETE_USER"})
+    response = client.get("/api/v1/audit-logs/count", params={"action": "DELETE_USER"})
 
     assert response.status_code == 200
     assert response.json() == {"count": 7}
@@ -88,7 +88,7 @@ def test_get_my_audit_logs_forces_current_user_id():
     )()
     client = _build_client(repo, metadata_user=current_user)
 
-    response = client.get("/audit/logs/my", params={"limit": 3})
+    response = client.get("/api/v1/audit-logs/mine", params={"limit": 3})
 
     assert response.status_code == 200
     repo.get_logs.assert_awaited_once()