feat: add safe diagnostics export

apps/api/app/main.py

@@ -258,8 +258,26 @@ def _admin(authorization: Annotated[str | None, Header()] = None) -> str:
 
 
 @app.get("/api/v1/admin/diagnostics")
-def admin_diagnostics(_: Annotated[str, Depends(_admin)]) -> dict[str, str]:
-    return {"version": settings.app_version, "revision": settings.app_revision, "environment": settings.deployment_environment}
+def admin_diagnostics(db: Db, _: Annotated[str, Depends(_admin)]) -> JSONResponse:
+    report_counts = {status.value: count for status, count in db.execute(
+        select(CatchReport.moderation_status, func.count()).group_by(CatchReport.moderation_status)
+    )}
+    observation_counts = {status: count for status, count in db.execute(
+        select(ExternalObservation.status, func.count()).group_by(ExternalObservation.status)
+    )}
+    payload = {
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+        "build": {"version": settings.app_version, "revision": settings.app_revision, "environment": settings.deployment_environment},
+        "counts": {
+            "catch_reports": report_counts,
+            "external_observations": observation_counts,
+            "data_sources": db.scalar(select(func.count()).select_from(DataSource)) or 0,
+            "enabled_data_sources": db.scalar(select(func.count()).select_from(DataSource).where(DataSource.enabled.is_(True))) or 0,
+            "official_import_runs": db.scalar(select(func.count()).select_from(OfficialRecordImport)) or 0,
+            "community_import_runs": db.scalar(select(func.count()).select_from(CommunityImportRun)) or 0,
+        },
+    }
+    return JSONResponse(payload, headers={"Content-Disposition": "attachment; filename=rf4spotter-diagnostics.json"})
 
 
 @app.get("/api/v1/imports", response_model=list[ImportRunOut])

apps/api/tests/test_api.py

@@ -89,7 +89,13 @@ def test_admin_diagnostics_exposes_build_identity_only_to_admin() -> None:
     assert client.get("/api/v1/admin/diagnostics").status_code == 401
     response = client.get("/api/v1/admin/diagnostics", headers={"Authorization": "Bearer change-me-in-production"})
     assert response.status_code == 200
-    assert response.json() == {"version": "0.1.0", "revision": "dev", "environment": "development"}
+    payload = response.json()
+    assert payload["build"] == {"version": "0.1.0", "revision": "dev", "environment": "development"}
+    assert set(payload) == {"generated_at", "build", "counts"}
+    assert response.headers["Content-Disposition"] == "attachment; filename=rf4spotter-diagnostics.json"
+    serialized = response.text.lower()
+    for forbidden in ("player_name", "source_url", "error_summary", "raw_payload", "admin_token", "s3_"):
+        assert forbidden not in serialized
 
 
 def test_spot_detail_and_catches() -> None: