L10b Betrieb & Aufräumen: /api/v1 über gemeinsamen Adapter, einheitliches Fehlerformat, Rate Limiting

Aufräumpunkt a: Die lane-lokalen API-Kontexte (imports/_context.ts, sync/api-context.ts,
reports/http.ts, work-orders/_http.ts mit moduleGuard) sind entfernt. Alle v1-Routen laufen über
requireApiContext (DB-autoritative Rechte, 401/403) und withApi/toErrorResponse (respond.ts):
- Fehlerformat überall { error: { code, message, details? } }; invalid und blocked → 422,
  conflict → 409, payload_too_large → 413, rate_limited → 429 + Retry-After.
- Same-Origin-Prüfung in withApi für jede Mutation vor der Anmeldung (vorher fehlte sie bei
  imports, reports und work-orders).
- Rate Limiting je Nutzer mit rate-limit.ts: api (API_RATE_LIMIT_PER_MINUTE, 300/min) und
  apiField für sync/uploads/field (API_FIELD_RATE_LIMIT_PER_MINUTE, 1200/min).
- Clients angepasst: Import-Uploader liest das neue Fehlerformat, Upload/Outbox werten 422 als
  endgültig ungültig (429 bleibt transient mit Backoff).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/app/api/v1/imports/[id]/confirm/route.ts

@@ -1,22 +1,13 @@
+import { requireApiContext } from "@/server/api/context";
+import { json, readJson, withApi } from "@/server/api/respond";
 import { confirmImport } from "@/server/services/imports/confirm";
-import { apiError, importsApiContext } from "../../_context";
 
 /**
  * POST /api/v1/imports/[id]/confirm — JSON body = review form (src/lib/imports/review.ts
  * `reviewFormSchema`). Creates/assigns customer, site, contact and the work order. Lane L3.
  */
-export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
-  try {
-    const ctx = await importsApiContext("import:write", "work_order:write");
-    const { id } = await params;
-    let body: unknown;
-    try {
-      body = await req.json();
-    } catch {
-      return Response.json({ error: "invalid", message: "json_required" }, { status: 400 });
-    }
-    return Response.json(await confirmImport(ctx, id, body));
-  } catch (err) {
-    return apiError(err);
-  }
-}
+export const POST = withApi(async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
+  const ctx = await requireApiContext("imports", "import:write", "work_order:write");
+  const { id } = await params;
+  return json(await confirmImport(ctx, id, await readJson(req)));
+});

src/app/api/v1/imports/[id]/route.ts

@@ -1,13 +1,10 @@
+import { requireApiContext } from "@/server/api/context";
+import { json, withApi } from "@/server/api/respond";
 import { getImportDetail } from "@/server/services/imports/queries";
-import { apiError, importsApiContext } from "../_context";
 
 /** GET /api/v1/imports/[id] — import status, extraction (with confidences), candidates. Lane L3. */
-export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
-  try {
-    const ctx = await importsApiContext("import:write");
-    const { id } = await params;
-    return Response.json(await getImportDetail(ctx, id));
-  } catch (err) {
-    return apiError(err);
-  }
-}
+export const GET = withApi(async (_req: Request, { params }: { params: Promise<{ id: string }> }) => {
+  const ctx = await requireApiContext("imports", "import:write");
+  const { id } = await params;
+  return json(await getImportDetail(ctx, id));
+});