get-anon-key and download-template disagree about the anon endpoint's shape, and both are on a deprecated route

[tonychang04]

What

Two tools call POST /api/auth/tokens/anon and disagree about its response shape.

tool	file	check
download-template	database.ts:190 / :243	requires accessToken to be a non-empty string (isAnonTokenResponse)
get-anon-key	docs.ts:140	no validation — formats whatever comes back as success

Nothing in the repo pinned which was right: no test, no fixture, and the
backend source is not in this repo.

Settled by a live call

Driven against the deployed slug with a real project on 2026-08-01:

get-anon-key      ok   "Anon key retrieved successfully (deprecated route,
                        use GET /api/metadata/anon-key)" { "accessToken": … }
download-template ok   "Template configuration ready…"

download-template succeeding is the proof: it only returns after
isAnonTokenResponse passes, which requires a non-empty accessToken. So the
backend does return accessToken, download-template is correct, and
get-anon-key is the lax one.

Why it still matters even though both currently pass

get-anon-key would report a malformed response as success. If the endpoint
ever changes shape — and see below, it is already deprecated — download-template
fails loudly with "Failed to retrieve anon key from backend" while
get-anon-key prints a cheerful success containing nothing usable. The failure
modes diverge exactly when a human most needs them to agree.

This is the same species as #104: a component asserting something a caller then
relies on, invisible until something makes a real call.

Also found by the same call

The live backend answers that route with "deprecated route, use
GET /api/metadata/anon-key". Both callers are on a deprecated endpoint, and
download-template is documented as "CRITICAL: MANDATORY FIRST STEP for all
new InsForge projects" — so the mandatory first step is the thing sitting on
the route that is going away.

Suggested

1. Give get-anon-key the same isAnonTokenResponse check, so both agree.
2. Move both to GET /api/metadata/anon-key before the deprecated route is
   removed.
3. A fixture pinning the response shape, so the next reader does not have to
   spend a live credential to learn it.

Found while completing the token -> session -> tool call span against the slug.