Serve API paths without the "v" prefix, matching develop and the spec

The shipped desktop app hardcodes https://repo.openshock.org/1 as a built-in
module repository (Desktop/Constants.cs, BuiltInModuleRepositories), and
develop's controllers route on "/{version:apiVersion}/". This branch had
changed them to "/v{version:apiVersion}/", so deploying it would have returned
404 to every installed desktop client for the module manifest and for module
version downloads.

firmware-api-spec.md documents the unprefixed form throughout ("/2/firmware/..."),
so the implementation disagreed with both the deployed clients and its own
contract. Routes now match: /1/ for the desktop endpoints and /2/firmware/...
for the firmware API.

Updates the two consumers written against the prefixed form in this branch —
the frontend client and the firmware OTA client, neither of which has shipped —
along with the CI ingestion action, the seeding script and the tests.

Author: hhvrc

CLAUDE.md

@@ -8,7 +8,7 @@ Unified repository server for distributing OpenShock desktop app modules and fir
 - PostgreSQL via Npgsql + EF Core (with DbContext pooling)
 - Serilog (console + Grafana Loki)
 - OpenTelemetry (Prometheus exporter)
-- API Versioning (Asp.Versioning) — URL-based: `/v1/`, `/v2/firmware/`
+- API Versioning (Asp.Versioning) — URL-based: `/1/`, `/2/firmware/`
 - FlexLabs.EntityFrameworkCore.Upsert for upserts
 - MiniValidation for config validation
 - Semver NuGet package for semver parsing
@@ -29,25 +29,25 @@ RepositoryServer/                    # Main web API project
   Controllers/
     OpenShockControllerBase.cs       # Shared base controller
     V1/                              # Desktop module endpoints (V1)
-      RepoController.cs              # GET /v1/ — desktop module manifest
-      AdminController.cs             # /v1/admin/... — desktop module CRUD
-      CiCdController.cs              # PUT /v1/cicd/modules/{id}/versions/{v} — desktop zip upload
+      RepoController.cs              # GET /1/ — desktop module manifest
+      AdminController.cs             # /1/admin/... — desktop module CRUD
+      CiCdController.cs              # PUT /1/cicd/modules/{id}/versions/{v} — desktop zip upload
     V2/Firmware/                     # Firmware V2 endpoints
-      ManifestController.cs          # GET /v2/firmware/manifest (bootstrap payload)
-      LatestController.cs            # GET /v2/firmware/latest/{channel}[/{board}?version=]
-      VersionsController.cs          # GET /v2/firmware/versions[/{version}[/{board}]]
-      BoardsController.cs            # GET /v2/firmware/boards
-      ChipsController.cs             # GET /v2/firmware/chips
-      ReleasesController.cs          # POST/PUT/DELETE /v2/firmware/releases/... (CI/CD ingestion)
+      ManifestController.cs          # GET /2/firmware/manifest (bootstrap payload)
+      LatestController.cs            # GET /2/firmware/latest/{channel}[/{board}?version=]
+      VersionsController.cs          # GET /2/firmware/versions[/{version}[/{board}]]
+      BoardsController.cs            # GET /2/firmware/boards
+      ChipsController.cs             # GET /2/firmware/chips
+      ReleasesController.cs          # POST/PUT/DELETE /2/firmware/releases/... (CI/CD ingestion)
       Admin/                         # AdminToken-protected CRUD (split by concern)
-        RepositoriesController.cs    # GET, DELETE /v2/firmware/admin/repositories
-        VersionsAdminController.cs   # DELETE /v2/firmware/admin/versions/{v}
-        BoardsAdminController.cs     # PUT, PATCH, DELETE /v2/firmware/admin/boards/{id}
+        RepositoriesController.cs    # GET, DELETE /2/firmware/admin/repositories
+        VersionsAdminController.cs   # DELETE /2/firmware/admin/versions/{v}
+        BoardsAdminController.cs     # PUT, PATCH, DELETE /2/firmware/admin/boards/{id}
                                      # + USB attach/detach
-        ChipsAdminController.cs      # PUT, DELETE /v2/firmware/admin/chips/{id} + USB attach/detach
-        ReleasesAdminController.cs   # PUT /v2/firmware/admin/releases/{id}/changelog (fix)
-        UsbDevicesController.cs      # PUT/GET/DELETE /v2/firmware/admin/usb-devices
-        UsbSerialFiltersController.cs # PUT/GET/DELETE /v2/firmware/admin/usb-serial-filters
+        ChipsAdminController.cs      # PUT, DELETE /2/firmware/admin/chips/{id} + USB attach/detach
+        ReleasesAdminController.cs   # PUT /2/firmware/admin/releases/{id}/changelog (fix)
+        UsbDevicesController.cs      # PUT/GET/DELETE /2/firmware/admin/usb-devices
+        UsbSerialFiltersController.cs # PUT/GET/DELETE /2/firmware/admin/usb-serial-filters
   Enums/                             # ReleaseChannel, FirmwareArtifactType, FirmwareChipArchitecture,
                                      # ReleaseNoteSectionType, ReleaseStatus, RepositoryProvider
   Errors/                            # AuthResultError, ExceptionError
@@ -97,7 +97,7 @@ docker/
   validates a GitHub Actions OIDC JWT, then looks up a matching row in the `repositories`
   table and attaches `AuthSchemas.CiCdClaims` to the principal. **Unregistered repositories are
   rejected** — the table is the publish allowlist, and a valid OIDC token alone says nothing about
-  which repo is calling. Onboarding is `PUT /v2/firmware/admin/repositories` (admin token).
+  which repo is calling. Onboarding is `PUT /2/firmware/admin/repositories` (admin token).
   Authorization does not stop there: release upload/publish/abort each re-check that the release
   belongs to the calling repository, and desktop modules carry an owning `repository_id`.
 - **Error Handling**: `OpenShockProblem` base class → `ToObjectResult()` for RFC 7807
@@ -113,7 +113,7 @@ docker/
 - **Metrics**: Prometheus at `/metrics`, restricted to private networks
 - **Notifications**: Fire-and-forget Discord webhooks via `IDiscordNotificationService`.
   Targets live in the `discord_webhooks` table, each subscribing to specific events, managed via
-  `/v2/admin/discord-webhooks`. The URL is a credential so it is write-only — responses return a
+  `/2/admin/discord-webhooks`. The URL is a credential so it is write-only — responses return a
   masked form. The service is a **singleton** that resolves its own `HttpClient` and `DbContext`:
   notifications outlive the request that triggers them, so capturing request-scoped ones dropped
   them non-deterministically. No subscribed webhooks → no-op.

RepositoryServer.Tests/Integration/Tests/AdvisoriesAdminControllerTests.cs

@@ -10,7 +10,7 @@ namespace OpenShock.RepositoryServer.Tests.Integration.Tests;
 [NotInParallel("repo-server-integration")]
 public class AdvisoriesAdminControllerTests
 {
-    private const string BasePath = "/v2/firmware/admin/advisories";
+    private const string BasePath = "/2/firmware/admin/advisories";
 
     [ClassDataSource<WebApplicationFactory>(Shared = SharedType.PerTestSession)]
     public required WebApplicationFactory Factory { get; init; }
@@ -172,7 +172,7 @@ public async Task Post_Advisory_AppearsOnPublicManifest()
         await Assert.That(createResponse.StatusCode).IsEqualTo(HttpStatusCode.Created);
 
         using var publicClient = Factory.CreateClient();
-        var manifest = await publicClient.GetFromJsonAsync<JsonElement>("/v2/firmware/manifest");
+        var manifest = await publicClient.GetFromJsonAsync<JsonElement>("/2/firmware/manifest");
         var advisories = manifest.GetProperty("advisories").EnumerateArray().ToList();
 
         await Assert.That(advisories).Count().IsEqualTo(1);

RepositoryServer.Tests/Integration/Tests/BoardsAdminControllerTests.cs

@@ -11,8 +11,8 @@ namespace OpenShock.RepositoryServer.Tests.Integration.Tests;
 [NotInParallel("repo-server-integration")]
 public class BoardsAdminControllerTests
 {
-    private const string BasePath = "/v2/firmware/admin/boards";
-    private const string ChipsPath = "/v2/firmware/admin/chips";
+    private const string BasePath = "/2/firmware/admin/boards";
+    private const string ChipsPath = "/2/firmware/admin/chips";
 
     [ClassDataSource<WebApplicationFactory>(Shared = SharedType.PerTestSession)]
     public required WebApplicationFactory Factory { get; init; }

RepositoryServer.Tests/Integration/Tests/ChipsAdminControllerTests.cs

@@ -11,7 +11,7 @@ namespace OpenShock.RepositoryServer.Tests.Integration.Tests;
 [NotInParallel("repo-server-integration")]
 public class ChipsAdminControllerTests
 {
-    private const string BasePath = "/v2/firmware/admin/chips";
+    private const string BasePath = "/2/firmware/admin/chips";
 
     [ClassDataSource<WebApplicationFactory>(Shared = SharedType.PerTestSession)]
     public required WebApplicationFactory Factory { get; init; }

RepositoryServer.Tests/Integration/Tests/DesktopCiCdControllerTests.cs

@@ -129,7 +129,7 @@ private static async Task<HttpResponseMessage> PublishAsync(HttpClient client, s
         var content = new MultipartFormDataContent();
         content.Add(new ByteArrayContent(BuildModuleZip()), "zip", "module.zip");
 
-        return await client.PutAsync($"/v1/cicd/modules/{ModuleId}/versions/{version}", content);
+        return await client.PutAsync($"/1/cicd/modules/{ModuleId}/versions/{version}", content);
     }
 
     /// <summary>Minimal zip passing the controller's root-entry validation (.dll/.pdb/.json only).</summary>

RepositoryServer.Tests/Integration/Tests/DiscordWebhooksControllerTests.cs

@@ -11,7 +11,7 @@ namespace OpenShock.RepositoryServer.Tests.Integration.Tests;
 [NotInParallel("repo-server-integration")]
 public class DiscordWebhooksControllerTests
 {
-    private const string BasePath = "/v2/admin/discord-webhooks";
+    private const string BasePath = "/2/admin/discord-webhooks";
     private const string WebhookUrl = "https://discord.com/api/webhooks/123456789/s3cr3t-token-value";
 
     [ClassDataSource<WebApplicationFactory>(Shared = SharedType.PerTestSession)]

RepositoryServer.Tests/Integration/Tests/LatestControllerTests.cs

@@ -23,15 +23,15 @@ public class LatestControllerTests
     public async Task GetLatest_InvalidChannel_Returns400()
     {
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync("/v2/firmware/latest/nightly");
+        var response = await client.GetAsync("/2/firmware/latest/nightly");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.BadRequest);
     }
 
     [Test]
     public async Task GetLatest_ChannelWithNoReleases_Returns404()
     {
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync("/v2/firmware/latest/stable");
+        var response = await client.GetAsync("/2/firmware/latest/stable");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.NotFound);
     }
 
@@ -41,7 +41,7 @@ public async Task GetLatest_HappyPath_ReturnsReleaseWithSourceAndBoards()
         var (boardId, _, _) = await SeedReleaseAsync("1.5.1", ReleaseChannel.Stable);
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync("/v2/firmware/latest/stable");
+        var response = await client.GetAsync("/2/firmware/latest/stable");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
 
         var body = await response.Content.ReadFromJsonAsync<JsonElement>();
@@ -63,15 +63,15 @@ await Assert.That(source.GetProperty("commitUrl").GetString())
     public async Task GetLatestForBoard_UnknownChannel_Returns400()
     {
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/nightly/{Guid.NewGuid()}");
+        var response = await client.GetAsync($"/2/firmware/latest/nightly/{Guid.NewGuid()}");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.BadRequest);
     }
 
     [Test]
     public async Task GetLatestForBoard_NoReleases_Returns404()
     {
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/stable/{Guid.NewGuid()}");
+        var response = await client.GetAsync($"/2/firmware/latest/stable/{Guid.NewGuid()}");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.NotFound);
     }
 
@@ -81,7 +81,7 @@ public async Task GetLatestForBoard_MatchingVersion_Returns204()
         var (boardId, _, _) = await SeedReleaseAsync("1.5.1", ReleaseChannel.Stable);
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/stable/{boardId}?version=1.5.1");
+        var response = await client.GetAsync($"/2/firmware/latest/stable/{boardId}?version=1.5.1");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.NoContent);
     }
 
@@ -91,7 +91,7 @@ public async Task GetLatestForBoard_DifferentVersion_Returns200WithArtifacts()
         var (boardId, _, _) = await SeedReleaseAsync("1.5.1", ReleaseChannel.Stable);
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/stable/{boardId}?version=1.4.0");
+        var response = await client.GetAsync($"/2/firmware/latest/stable/{boardId}?version=1.4.0");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
 
         var body = await response.Content.ReadFromJsonAsync<JsonElement>();
@@ -106,7 +106,7 @@ public async Task GetLatestForBoard_NoVersionParam_Returns200()
         var (boardId, _, _) = await SeedReleaseAsync("1.5.1", ReleaseChannel.Stable);
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/stable/{boardId}");
+        var response = await client.GetAsync($"/2/firmware/latest/stable/{boardId}");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
     }
 
@@ -116,7 +116,7 @@ public async Task GetLatestForBoard_ByName_Returns200WithNameEchoed()
         await SeedReleaseAsync("1.5.1", ReleaseChannel.Stable);
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/stable/{BoardName}?version=1.4.0");
+        var response = await client.GetAsync($"/2/firmware/latest/stable/{BoardName}?version=1.4.0");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
 
         var body = await response.Content.ReadFromJsonAsync<JsonElement>();
@@ -130,7 +130,7 @@ public async Task GetLatestForBoard_ByNameDifferentCase_Returns200WithCanonicalN
 
         using var client = Factory.CreateClient();
         var response = await client.GetAsync(
-            $"/v2/firmware/latest/stable/{BoardName.ToLowerInvariant()}?version=1.4.0");
+            $"/2/firmware/latest/stable/{BoardName.ToLowerInvariant()}?version=1.4.0");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
 
         // The canonical stored spelling comes back, not what the caller sent.
@@ -144,7 +144,7 @@ public async Task GetLatestForBoard_ByName_MatchingVersion_Returns204()
         await SeedReleaseAsync("1.5.1", ReleaseChannel.Stable);
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/stable/{BoardName}?version=1.5.1");
+        var response = await client.GetAsync($"/2/firmware/latest/stable/{BoardName}?version=1.5.1");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.NoContent);
     }
 
@@ -155,7 +155,7 @@ public async Task GetLatestForBoard_ArtifactUrlUsesImmutableBoardId()
 
         using var client = Factory.CreateClient();
         var body = await client.GetFromJsonAsync<JsonElement>(
-            $"/v2/firmware/latest/stable/{BoardName}");
+            $"/2/firmware/latest/stable/{BoardName}");
 
         // Storage paths are keyed by the board id so a rename cannot strand published artifacts,
         // while the response still labels the board by name.
@@ -173,7 +173,7 @@ public async Task GetLatestForBoard_UnknownName_Returns404NotNoContent()
         // An unknown board must not be masked as "already up to date" just because the
         // version query happens to match the latest release.
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync("/v2/firmware/latest/stable/No-Such-Board?version=1.5.1");
+        var response = await client.GetAsync("/2/firmware/latest/stable/No-Such-Board?version=1.5.1");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.NotFound);
     }
 
@@ -183,7 +183,7 @@ public async Task GetLatestForBoard_UnknownBoard_Returns404()
         await SeedReleaseAsync("1.5.1", ReleaseChannel.Stable);
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync($"/v2/firmware/latest/stable/{Guid.NewGuid()}");
+        var response = await client.GetAsync($"/2/firmware/latest/stable/{Guid.NewGuid()}");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.NotFound);
     }
 
@@ -197,7 +197,7 @@ public async Task GetLatest_BetaChannel_IncludesNewerStableRelease()
         await AddVersionAsync("1.5.0", ReleaseChannel.Stable, DateTimeOffset.UtcNow, repoId);
 
         using var client = Factory.CreateClient();
-        var body = await client.GetFromJsonAsync<JsonElement>("/v2/firmware/latest/beta");
+        var body = await client.GetFromJsonAsync<JsonElement>("/2/firmware/latest/beta");
         await Assert.That(body.GetProperty("version").GetString()).IsEqualTo("1.5.0");
     }
 
@@ -209,7 +209,7 @@ public async Task GetLatest_StableChannel_ExcludesBetaReleases()
         await AddVersionAsync("1.6.0-beta.1", ReleaseChannel.Beta, DateTimeOffset.UtcNow.AddDays(1), repoId);
 
         using var client = Factory.CreateClient();
-        var body = await client.GetFromJsonAsync<JsonElement>("/v2/firmware/latest/stable");
+        var body = await client.GetFromJsonAsync<JsonElement>("/2/firmware/latest/stable");
         await Assert.That(body.GetProperty("version").GetString()).IsEqualTo("1.5.0");
     }
 
@@ -225,19 +225,19 @@ public async Task GetLatest_TiedReleaseDates_ResolvesDeterministicallyAndAgreesW
 
         using var client = Factory.CreateClient();
 
-        var first = await client.GetFromJsonAsync<JsonElement>("/v2/firmware/latest/stable");
+        var first = await client.GetFromJsonAsync<JsonElement>("/2/firmware/latest/stable");
         var picked = first.GetProperty("version").GetString();
         await Assert.That(picked).IsEqualTo("1.5.2");
 
         // Stable across repeated calls...
         for (var i = 0; i < 3; i++)
         {
-            var again = await client.GetFromJsonAsync<JsonElement>("/v2/firmware/latest/stable");
+            var again = await client.GetFromJsonAsync<JsonElement>("/2/firmware/latest/stable");
             await Assert.That(again.GetProperty("version").GetString()).IsEqualTo(picked);
         }
 
         // ...and consistent with the manifest, which computes latest independently.
-        var manifest = await client.GetFromJsonAsync<JsonElement>("/v2/firmware/manifest");
+        var manifest = await client.GetFromJsonAsync<JsonElement>("/2/firmware/manifest");
         await Assert.That(manifest.GetProperty("latest").GetProperty("stable").GetString())
             .IsEqualTo(picked);
     }

RepositoryServer.Tests/Integration/Tests/ManifestControllerTests.cs

@@ -21,7 +21,7 @@ public async Task GetManifest_EmptyDatabase_ReturnsShellWithFixedChannels()
     {
         using var client = Factory.CreateClient();
 
-        var response = await client.GetAsync("/v2/firmware/manifest");
+        var response = await client.GetAsync("/2/firmware/manifest");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
 
         var manifest = await response.Content.ReadFromJsonAsync<JsonElement>();
@@ -111,7 +111,7 @@ public async Task GetManifest_WithSeededData_ReturnsFullShape()
         }
 
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync("/v2/firmware/manifest");
+        var response = await client.GetAsync("/2/firmware/manifest");
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
 
         var manifest = await response.Content.ReadFromJsonAsync<JsonElement>();
@@ -156,7 +156,7 @@ await Assert.That(Guid.Parse(devices[0].GetProperty("id").GetString()!))
     public async Task GetManifest_SendsCacheControlHeader()
     {
         using var client = Factory.CreateClient();
-        var response = await client.GetAsync("/v2/firmware/manifest");
+        var response = await client.GetAsync("/2/firmware/manifest");
 
         await Assert.That(response.StatusCode).IsEqualTo(HttpStatusCode.OK);
         await Assert.That(response.Headers.CacheControl).IsNotNull();