refactor: api router & new endpoint structure & auth logic (#668)

* fix: return 401 for malformed bearer token + add expired JWT tests

ErrInvalidBearerToken now returns 401 instead of 400 — a malformed
bearer token is an authentication failure, not a bad request.

Add expired JWT tests for Extract, TenantJWTAuthMiddleware, and
APIKeyOrTenantJWTAuthMiddleware.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* refactor: introduce AuthMode + TenantScoped, flatten route list

Replace AuthScope/RouteMode with simpler AuthMode enum and TenantScoped
bool. Flatten 5 route slices into 2 (nonTenantRoutes + tenantRoutes)
with portal routes conditionally appended. Auto-apply
RequireTenantMiddleware via TenantScoped instead of manual Middlewares
arrays. Define narrow TenantRetriever interface to decouple middleware
from full TenantStore. Change mustTenantFromContext to panic on missing
tenant (programming bug, not user error).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore: update handlers to use mustTenantFromContext

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore: remove dead code — ErrTenantIDNotFound, SetTenantIDMiddleware, mustTenantIDFromContext

- Remove 3 dead symbols from auth_middleware.go
- Remove TestSetTenantIDMiddleware from auth_middleware_test.go
- RequireTenantMiddleware reads c.Param("tenantID") instead of c.Get
- Remove SetTenantIDMiddleware() from router global middleware
- Upsert handler uses c.Param("tenantID") directly

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore: gofmt

* refactor: rename AuthTenant -> AuthAuthenticated

* chore: rename AuthenticatedMiddleware

* refactor: simplify auth context between apikey & jwt

* test: remove old test files

* refactor: simplify router deps

* test: apirouter test setup

* test: tenant handlers

* test: destination handlers

* test: log handlers

* test: resource parent & authz

* fix: validate destination ownership in RetrieveAttempt

* test: comprehensive list & pagination tests

* test: list tenant not supported

* test: publish & retry api tests

* fix: consistent validation handling

* fix: clean up dead code and nil-check inconsistency in apirouter

* test: add missing apirouter test coverage for auth, tokens, portal, and destination types

* refactor: consolidate middleware into unified AuthMiddleware

* chore: rename path names to snake_case

* test: tenant metadata conversion

* test: clean up e2e tests

* test: comprehensive e2e suite

* test: topic matching

* chore: gofmt

* test: move e2e tests into apirouter

* fix: attempt response schema

* chore: upgrade Dockerfiles to Go 1.24

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore: openapi.yaml

* fix: portal using new endpoints (#671)

* fix: use new endpoint structure

* fix: destination attempt queries

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: alexluong

build/Dockerfile.example

@@ -12,7 +12,7 @@
 
 # Stage 0
 # Build the binaries
-FROM golang:1.23-alpine
+FROM golang:1.24-alpine
 WORKDIR /app
 COPY go.mod go.sum ./
 RUN go mod download

build/dev/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS fetch
+FROM golang:1.24-alpine AS fetch
 RUN go install github.com/air-verse/air@v1.61.1
 WORKDIR /app
 COPY . .