test(api): cover source resolution and orchestration

[Vittuu]

Summary

• centralize source resolution into shared helpers used by enhanced API flows
• add provider-backed orchestration seams and focused tests for source dispatch
• cover SSRF and transport safety paths in the API layer

Why

The API/source slice was the next clean dependency after suite stabilization. This PR makes source identification and provider routing testable in isolation, and it locks in the security-sensitive transport behavior with hermetic tests.

Validation

• go test ./internal/api -count=1
• go test ./internal/api -cover -count=1
• go build ./cmd/goanime
• go run ./cmd/goanime --version
• go run ./cmd/goanime --help

Notes

• This stays draft while GitHub checks run.
• Full repo short-suite execution in this fresh worktree exceeded the local command timeout, so GitHub CI remains the source of truth for whole-repo validation.

[codacy-production]

Not up to standards ⛔

🔴 Issues 2 minor

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category	Results
Documentation	2 minor

View in Codacy

🟢 Metrics 143 complexity · 3 duplication

Metric	Results
Complexity	143
Duplication	3

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 39317fe...d64f551 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		May 2, 2026 2:18a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.