Add user catch submission and moderation workflow

apps/api/tests/test_api.py

@@ -66,3 +66,22 @@ def test_records_list_is_empty_before_import() -> None:
     response = client.get("/api/v1/records")
     assert response.status_code == 200
     assert response.json() == []
+
+
+def test_user_report_requires_moderation_before_activity() -> None:
+    created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 77, "y": 88, "weight_g": 5500, "bait_name": "Новая приманка", "player_name": "Reporter"})
+    assert created.status_code == 201
+    assert created.json()["moderation_status"] == "pending"
+    report_id = created.json()["id"]
+    headers = {"Authorization": "Bearer change-me-in-production"}
+    pending = client.get("/api/v1/admin/catch-reports", headers=headers)
+    assert pending.status_code == 200
+    assert any(item["id"] == report_id for item in pending.json())
+    approved = client.patch(f"/api/v1/admin/catch-reports/{report_id}", headers=headers, json={"status": "approved", "reason": "fixture verified"})
+    assert approved.status_code == 200
+    activity = client.get("/api/v1/activity?waterbody=test-lake&fish=pike&hours=24").json()
+    assert any(item["x"] == 77 and item["catches"] == 1 for item in activity)
+
+
+def test_admin_requires_token() -> None:
+    assert client.get("/api/v1/admin/catch-reports").status_code == 401