refactor(api): standardize all API routes with withApi, apiFetch, Zod validation, and security hardening #5

	name: API CI

	on:
	pull_request:
	branches:
	- master
	paths:
	- 'app/api/**'
	- 'lib/api/**'
	- 'lib/auth/**'
	- 'lib/rateLimit.ts'
	- 'lib/protectedRoute.ts'
	- 'server/services/**'
	- 'prisma/schema.prisma'
	- 'tests/api/**'
	- 'components/*/.ts'
	- 'components/*/.tsx'
	- 'hooks/*/.ts'

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	ci:
	name: CI
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

	- name: Setup Node.js
	uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
	with:
	node-version: '22'
	cache: 'yarn'

	- name: Install dependencies
	run: yarn install --frozen-lockfile

	# ── Core checks ──────────────────────────────────────

	- name: Type check
	run: npx tsc --noEmit

	# ── API conventions ──────────────────────────────────

	- name: ESLint (API routes)
	run: npx eslint app/api/ --max-warnings 0

	- name: API standards (security + quality)
	run: bash ./scripts/check-api-standards.sh

	- name: API tests
	run: npx vitest run tests/api/ --reporter=verbose

Provide feedback