refactor: make API registry authoritative

server.py

@@ -16,8 +16,9 @@ from typing import Any
 from urllib.parse import parse_qs, unquote, urlparse
 
 from assistant_agent import ReviewAssistantError, stream_review_assistant
-from api_access import required_role
+from api_access import ROUTES
 from backend.bootstrap import build_application_container, load_runtime_settings
+from backend.http import correlation_id, normalize_error_payload
 from chart_data_provider import ChartDataError
 from app_config import (
     DATA_DIR,
@@ -5581,7 +5582,13 @@ class RequestHandler(BaseHTTPRequestHandler):
         return False
 
     def require_access(self, method: str, path: str) -> bool:
-        role = required_role(method, path)
+        route = ROUTES.resolve(method, path)
+        if route is None:
+            self.send_json({"error": "Not found"}, HTTPStatus.NOT_FOUND)
+            return False
+        role = route.access
+        if role == "public":
+            return True
         if role == "admin":
             return self.require_admin()
         if role == "member":
@@ -5912,11 +5919,17 @@ class RequestHandler(BaseHTTPRequestHandler):
         status: HTTPStatus = HTTPStatus.OK,
         headers: dict[str, str] | None = None,
     ) -> None:
+        request_id = getattr(self, "_correlation_id", "")
+        if not request_id:
+            request_id = correlation_id(self.headers.get("X-Request-ID", ""))
+            self._correlation_id = request_id
+        payload = normalize_error_payload(payload, status, request_id)
         content = json.dumps(payload, ensure_ascii=False).encode("utf-8")
         self.send_response(status)
         self.send_header("Content-Type", "application/json; charset=utf-8")
         self.send_header("Content-Length", str(len(content)))
         self.send_header("Cache-Control", "no-store")
+        self.send_header("X-Request-ID", request_id)
         for name, value in (headers or {}).items():
             self.send_header(name, value)
         self.end_headers()