feat: extend admin operations and media review

apps/api/tests/test_api.py

@@ -56,6 +56,17 @@ def test_activity_filters_and_explains_score() -> None:
     assert payload["items"][0]["sources"] == ["manual-import"]
 
 
+def test_waterbody_catalog_exposes_nullable_source_provenance() -> None:
+    response = client.get("/api/v1/waterbodies")
+    assert response.status_code == 200
+    item = next(row for row in response.json() if row["slug"] == "test-lake")
+    assert item["source_system"] is None
+    assert item["source_external_id"] is None
+    assert item["source_url"] is None
+    assert item["description"] is None
+    assert item["source_checked_at"] is None
+
+
 def test_invalid_period_is_rejected() -> None:
     assert client.get("/api/v1/activity?hours=13").status_code == 422
     assert client.get("/api/v1/activity?sort=unknown").status_code == 422
@@ -151,6 +162,24 @@ def test_public_source_status_hides_internal_details() -> None:
     assert all("error_summary" not in item and "source_url" not in item for item in response.json())
 
 
+def test_admin_source_status_requires_auth_and_exposes_safe_cooldown_fields() -> None:
+    assert client.get("/api/v1/admin/source-status").status_code == 401
+    response = client.get("/api/v1/admin/source-status", headers={"Authorization": "Bearer change-me-in-production"})
+    assert response.status_code == 200
+    assert response.json()
+    assert all({"status", "cooldown_seconds", "recent_failures_24h", "backoff_recommended"} <= set(item) for item in response.json())
+    assert all("error_summary" not in item and "base_url" not in item for item in response.json())
+
+
+def test_admin_media_review_requires_auth() -> None:
+    assert client.get("/api/v1/admin/media/catalog").status_code == 401
+    response = client.get("/api/v1/admin/media/catalog?status=approved&limit=2", headers={"Authorization": "Bearer change-me-in-production"})
+    assert response.status_code == 200
+    assert len(response.json()) <= 2
+    if response.json():
+        assert {"status", "width", "height", "source_system", "source_url", "derivatives"} <= set(response.json()[0])
+
+
 def test_liveness_does_not_probe_dependencies() -> None:
     response = client.get("/health?token=must-not-be-logged")
     assert response.json() == {"status": "ok"}