Phase 4: move catalog controllers and routes into WarpEngine

- update, files and the 6 /api catalog controllers now live in the engine on
  a new WarpEngine::ApiController base (same rescue/mime behavior as host)
- engine routes serve /update, /file/*path, /api/software*, /api/builds*,
  /api/image/:id, /api/download at unchanged public paths via the root mount;
  host routes keep only TTG endpoints (events, members, wiki, rss, swagger)
- /update secret comes from WarpEngine.config.update_secret and an
  unconfigured secret now rejects every request (previously an empty
  UPDATE_SECRET env accepted empty secrets)
- apipie-rails is an engine dependency (DSL in engine controllers); dummy app
  configures apipie with validation off, mirroring the host
- engine request specs: catalog controller specs moved from host plus new
  /update auth contract spec

Verified: engine suite 53 green, host suite 6 green, /api/software and
/api/builds byte-identical to baselines, /update 401/400 behavior intact,
admin and TTG endpoints OK.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/spec/controllers/builds_controller_spec.rb

@@ -1,16 +0,0 @@
-require "rails_helper"
-
-RSpec.describe Api::BuildsController, type: :request do
-  describe "GET /api/builds" do
-    it "returns the global build matrix" do
-      get "/api/builds"
-
-      expect(response).to have_http_status(:ok)
-      json = JSON.parse(response.body)
-      expect(json["platforms"]).to be_a(Hash)
-      expect(json["platforms"]["tic80"]["label"]).to eq("TIC-80")
-      expect(json["platforms"]["tic80"]["kinds"]).to include("cartridge")
-      expect(json["allKinds"]).to be_an(Array)
-    end
-  end
-end

apps/api/spec/controllers/downloads_controller_spec.rb

@@ -1,21 +0,0 @@
-require "rails_helper"
-
-RSpec.describe Api::DownloadsController, type: :request do
-  describe "GET /api/download" do
-    it "returns bad_request without path" do
-      get "/api/download"
-
-      expect(response).to have_http_status(:bad_request)
-      json = JSON.parse(response.body)
-      expect(json["error"]).to eq("Path is required")
-    end
-
-    it "returns not_found for invalid path" do
-      get "/api/download", params: { path: "nonexistent/file.tic" }
-
-      expect(response).to have_http_status(:not_found)
-      json = JSON.parse(response.body)
-      expect(json["error"]).to eq("Not found")
-    end
-  end
-end

apps/api/spec/controllers/software_builds_controller_spec.rb

@@ -1,29 +0,0 @@
-require "rails_helper"
-
-RSpec.describe Api::SoftwareBuildsController, type: :request do
-  describe "GET /api/softwares/:name/builds" do
-    let!(:software) { create(:software, name: "test-game", platform: "love") }
-    let!(:release) { create(:release, software: software, version: "2.0.0") }
-
-    before do
-      WarpEngine::ReleaseAsset.create!(release: release, kind: "html", path: "/test/html")
-    end
-
-    it "returns per-software build info" do
-      get "/api/softwares/test-game/builds"
-
-      expect(response).to have_http_status(:ok)
-      json = JSON.parse(response.body)
-      expect(json["platform"]).to eq("love")
-      expect(json["expected"]).to include("html", "win_x64")
-      expect(json["releases"]["2.0.0"]["actual"]).to include("html")
-      expect(json["releases"]["2.0.0"]["missing"]).to include("win_x64")
-    end
-
-    it "returns 404 for unknown software" do
-      get "/api/softwares/nonexistent/builds"
-
-      expect(response).to have_http_status(:not_found)
-    end
-  end
-end

apps/api/spec/controllers/software_controller_spec.rb

@@ -1,42 +0,0 @@
-require "rails_helper"
-
-RSpec.describe Api::SoftwareController, type: :request do
-  describe "GET /api/software" do
-    it "returns all software with releases" do
-      create(:software, name: "test-game", title: "Test Game")
-
-      get "/api/software"
-
-      expect(response).to have_http_status(:ok)
-      json = JSON.parse(response.body)
-      expect(json["softwares"]).to be_an(Array)
-      expect(json["softwares"].length).to eq(1)
-    end
-
-    it "returns per-release and total download counts" do
-      software = create(:software)
-      release  = create(:release, software: software)
-      other    = create(:release, software: software)
-      create_list(:download, 3, release: release)
-      create(:download, release: other)
-
-      get "/api/software"
-
-      json = JSON.parse(response.body)
-      sw = json["softwares"].first
-      expect(sw["totalDownloads"]).to eq(4)
-      counts = sw["releases"].to_h { |r| [ r["id"], r["downloadCount"] ] }
-      expect(counts[release.id]).to eq(3)
-      expect(counts[other.id]).to eq(1)
-    end
-
-    it "excludes soft-deleted software" do
-      create(:software, deleted_at: Time.current)
-
-      get "/api/software"
-
-      json = JSON.parse(response.body)
-      expect(json["softwares"]).to be_empty
-    end
-  end
-end