feat: add admin media upgrade decisions

apps/api/tests/test_api.py

@@ -13,6 +13,7 @@ from app.community_importer import stage_observations
 from app.importer import ImportAlreadyRunning
 from app.main import app
 from app.models import Bait, BaitKind, CatchReport, DataSource, ExternalEntityAlias, ExternalObservation, Fish, ImportStatus, ModerationEvent, ModerationStatus, OfficialRecordImport, SourceType, Spot, SubmissionAttempt, Waterbody
+from app.routers import admin as admin_router
 
 
 engine = create_engine("sqlite://", connect_args={"check_same_thread": False}, poolclass=StaticPool)
@@ -182,6 +183,34 @@ def test_admin_media_review_requires_auth() -> None:
         assert all({"role", "format", "width", "height"} <= set(derivative) for derivative in response.json()[0]["derivatives"])
 
 
+def test_admin_media_decisions_require_auth_and_note(monkeypatch) -> None:
+    assert client.post("/api/v1/admin/media/upgrades/publish", json={"note": "publish"}).status_code == 401
+    assert client.post("/api/v1/admin/media/upgrades/rollback", json={"asset_url": "https://example.test/a", "note": "rollback"}).status_code == 401
+
+    monkeypatch.setattr(admin_router, "publish_quality_upgrades", lambda path, note: {"published": 2, "retained_fallbacks": 2})
+    publish = client.post(
+        "/api/v1/admin/media/upgrades/publish",
+        json={"note": "visual review complete"},
+        headers={"Authorization": "Bearer change-me-in-production"},
+    )
+    assert publish.status_code == 200
+    assert publish.json() == {"published": 2, "retained_fallbacks": 2}
+
+    monkeypatch.setattr(admin_router, "rollback_quality_upgrade", lambda path, asset_url, note: {"rolled_back": asset_url, "restored": "https://example.test/fallback"})
+    rollback = client.post(
+        "/api/v1/admin/media/upgrades/rollback",
+        json={"asset_url": "https://example.test/a", "note": "fallback is preferred"},
+        headers={"Authorization": "Bearer change-me-in-production"},
+    )
+    assert rollback.status_code == 200
+    assert rollback.json()["rolled_back"] == "https://example.test/a"
+    assert client.post(
+        "/api/v1/admin/media/upgrades/publish",
+        json={"note": ""},
+        headers={"Authorization": "Bearer change-me-in-production"},
+    ).status_code == 422
+
+
 def test_liveness_does_not_probe_dependencies() -> None:
     response = client.get("/health?token=must-not-be-logged")
     assert response.json() == {"status": "ok"}