test(server): API integration tests with Axum test harness (COD-380)

[shivros]

Summary

Closes COD-380

Adds comprehensive integration tests for PostGhost's public /api/v1/* HTTP API endpoints. Previously, only the storage layer had test coverage — every API regression went undetected until manual testing.

Changes

New file: crates/postghost-server/tests/api_test.rs (23 tests)

Uses axum::body::Body + tower::ServiceExt::oneshot against in-memory SQLite (SqliteStorage::in_memory()). IrisClient points at 127.0.0.1:1 (never listening) to ensure no real network calls during tests.

Coverage:

• Health: GET /health returns status ok
• Content CRUD: create (201 + ID), create with tags/format, missing fields (422), list empty, list populated, get by ID, get missing (404), get invalid UUID (400), delete + verify gone, delete missing
• Variants: create variant (201), variant on missing content (500 via FK)
• Workflow transitions: valid single, chained (Draft→InReview→Approved→Published), invalid transition (422), missing content (404)
• Scheduling: create schedule (201), invalid UUID (400), invalid date (400), list empty, list after create

Bug fix: crates/postghost-server/src/api.rs

Pre-existing route syntax bug: routes used :id captures (axum 0.7 syntax) but the project depends on axum 0.8, which requires {id} syntax. This caused build_router_from_arc() to panic at runtime — meaning the server would crash on startup. Changed all 5 route definitions to {id}.

Verification

cargo test --all-targets        → 79 tests pass (0 failures)
cargo clippy --all-targets -- -D warnings  → clean
cargo fmt --all -- --check      → clean

Review Panel

Both reviewers approved. See review panel comment below.

[shivros]

🤖 Automated Review Panel

GPT-5.5 (openai/gpt-5.5)

Verdict: ✅ Approve. The change achieves the stated goal, all CI gates are green, and the work is correct.

What was verified:

• All 23 new tests pass (cargo test -p postghost-server --test api_test → 23/23 ok)
• Full workspace tests pass — 79 tests total across all crates, 0 failures
• cargo fmt --check — clean
• cargo clippy -p postghost-server --tests -- -D warnings — clean
• Axum version confirmed 0.8.9 in Cargo.lock — the {id} fix is necessary and correct

Goal alignment: Every required test case from COD-380 is present. Bonus coverage includes 400 on invalid UUID, invalid schedule date, missing-title 422, chained transitions, delete verification.

Correctness: No bugs found. The route-syntax bug fix is real and critical — :id captures panic at runtime in axum 0.8.

Conventions: No violations. No storage read-modify-write logic touched, no Platform parsing via serde introduced, no text-length comparisons touched.

Recommendation: Merge as-is.

---

Gemini 3 Flash (google/gemini-3-flash-preview)

Verdict: Ship-worthy for the core goal, with two notes addressed.

What was verified: All 23 tests pass, full workspace green, clippy clean, fmt clean. The :id → {id} route fix is correct and necessary for axum 0.8.9.

Issues flagged (both addressed post-review):

1. IrisClient network call in /health test — The health handler calls iris_client.health() which makes a real HTTP request to localhost:8090. On a machine with something listening on :8090, the test would fail for environment reasons. Fixed: Changed IrisClient to point at 127.0.0.1:1 (privileged port, never listening) so all Iris health checks fail immediately with connection-refused.

2. IrisClient not trait-ified — The task suggested trait-ifying IrisClient for proper mocking. This was not done because no test exercises the publish endpoint (which would require Iris). The concrete struct approach works correctly for all current tests. Trait-ification can be deferred to when publish tests are added.

Bottom line: The route-syntax fix alone is a genuine, correctly-scoped bug fix that justifies part of the PR. API test coverage is comprehensive and matches the task spec.

[shivros]

Auto-Merge Gate — Approved

Confidence: 0.92 (threshold: 0.80)

Rationale: PR fully satisfies COD-380 acceptance criteria — all 8 required API endpoint test cases are covered (23 tests total, including bonus edge cases). CI gates all green: Formatting, Clippy, Tests, Build, Secret Scanning. Review panel (GPT-5.5 + Gemini 3 Flash) both approved with no blocking issues. The api.rs route-syntax fix (:id → {id}) is a necessary axum 0.8 compatibility fix that prevents a runtime panic in build_router_from_arc().

Checks observed: Formatting ✅, Clippy ✅, Tests ✅ (79 total), Build ✅, Secret Scanning ✅

Scope: 2 files changed (1 new test file + 5-line route syntax fix). No secrets, auth, deployment, billing, or destructive changes touched.

Linear: COD-380 — no manual-review markers in issue description or comments.