fix: type admin API contracts

apps/api/tests/test_api.py

@@ -168,6 +168,7 @@ def test_admin_source_status_requires_auth_and_exposes_safe_cooldown_fields() ->
     assert response.status_code == 200
     assert response.json()
     assert all({"status", "cooldown_seconds", "recent_failures_24h", "backoff_recommended"} <= set(item) for item in response.json())
+    assert all({"source_system", "name", "last_started_at", "last_success_at", "next_allowed_at"} <= set(item) for item in response.json())
     assert all("error_summary" not in item and "base_url" not in item for item in response.json())
 
 
@@ -178,6 +179,7 @@ def test_admin_media_review_requires_auth() -> None:
     assert len(response.json()) <= 2
     if response.json():
         assert {"status", "width", "height", "source_system", "source_url", "derivatives"} <= set(response.json()[0])
+        assert all({"role", "format", "width", "height"} <= set(derivative) for derivative in response.json()[0]["derivatives"])
 
 
 def test_liveness_does_not_probe_dependencies() -> None: