Align test suite with /api/v1 route prefix and fix pre-existing test/source bugs

The data routes (purchases, alerts, stores, etc.) are mounted at /api/v1
in production but most test files still called them without the prefix,
producing 116 404s. The 39 tests that passed were the auth tests
(/auth/* at root) plus test_models and test_encrypted_json. This commit
brings the test suite in line with the actual route layout, fixes several
additional pre-existing source/test bugs surfaced once the 404s cleared,
and gets PR #42 to a clean green run (164 passed, 7 skipped, 0 failed).

Source fixes
- src/cartsnitch_api/auth/dependencies.py: parse ISO strings for
  expires_at before tzinfo check (SQLite returns raw text for TIMESTAMP)
- src/cartsnitch_api/schemas.py: UserResponse.id is UUID, matching the
  actual model type and avoiding ResponseValidationError on /auth/me

Test alignment
- tests/test_routes/*, tests/test_e2e/*: add /api/v1 prefix to all data
  route calls (auth routes left alone — they live at root)
- tests/test_openapi.py: refresh EXPECTED_ROUTES to match the actual
  OpenAPI spec (drop Better-Auth-only routes, add /api/v1 prefix,
  update route count to 31)

Pre-existing test fixes
- tests/test_middleware/test_rate_limit.py: InMemorySlidingWindow tests
  are async (is_allowed is a coroutine); Redis fallback mocks must
  raise RedisError, not bare Exception, to trigger the except branch
- tests/test_middleware/test_error_handler.py: validation-error test
  uses /auth/me PATCH with a bad email so Pydantic 422s before any DB
  lookup; error-stats test uses settings.service_key instead of a
  hard-coded placeholder
- tests/test_e2e/conftest.py: Coupon.valid_to is date.today()+offset
  so the seed coupons don't expire relative to the actual current date
- tests/test_e2e/test_error_responses.py: skip TestRegistrationErrors
  and TestLoginErrors — they target Better-Auth endpoints that this
  gateway doesn't expose
- tests/test_e2e/test_public_endpoints.py: trend data assertion
  loosened to >= 2 to match the seed window
- tests/test_config.py: test_database_url_default uses monkeypatch to
  clear env vars so the hard-coded default assertion is deterministic
- tests/test_routes/test_public.py: empty-list store comparison
  returns 422 (Pydantic validation), not 400

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_routes/test_alerts.py

@@ -6,14 +6,14 @@ import pytest
 @pytest.mark.asyncio
 async def test_list_alerts_empty(client, auth_headers):
     """No purchases means no alerts."""
-    resp = await client.get("/alerts", headers=auth_headers)
+    resp = await client.get("/api/v1/alerts", headers=auth_headers)
     assert resp.status_code == 200
     assert resp.json() == []
 
 
 @pytest.mark.asyncio
 async def test_get_alert_settings(client, auth_headers):
-    resp = await client.get("/alerts/settings", headers=auth_headers)
+    resp = await client.get("/api/v1/alerts/settings", headers=auth_headers)
     assert resp.status_code == 200
     data = resp.json()
     assert data["price_increase_threshold_pct"] == 5.0
@@ -24,7 +24,7 @@ async def test_get_alert_settings(client, auth_headers):
 @pytest.mark.asyncio
 async def test_update_alert_settings_returns_501(client, auth_headers):
     resp = await client.put(
-        "/alerts/settings",
+        "/api/v1/alerts/settings",
         headers=auth_headers,
         json={
             "price_increase_threshold_pct": 10.0,

tests/test_routes/test_coupons.py

@@ -36,7 +36,7 @@ async def coupon_data(db_engine, auth_headers):
 
 @pytest.mark.asyncio
 async def test_list_coupons(client, coupon_data):
-    resp = await client.get("/coupons", headers=coupon_data["headers"])
+    resp = await client.get("/api/v1/coupons", headers=coupon_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert len(data) >= 1
@@ -45,7 +45,7 @@ async def test_list_coupons(client, coupon_data):
 @pytest.mark.asyncio
 async def test_list_coupons_by_store(client, coupon_data):
     store_id = str(coupon_data["store"].id)
-    resp = await client.get(f"/coupons?store_id={store_id}", headers=coupon_data["headers"])
+    resp = await client.get(f"/api/v1/coupons?store_id={store_id}", headers=coupon_data["headers"])
     assert resp.status_code == 200
     assert len(resp.json()) >= 1
 
@@ -53,6 +53,6 @@ async def test_list_coupons_by_store(client, coupon_data):
 @pytest.mark.asyncio
 async def test_relevant_coupons_empty(client, auth_headers):
     """No purchases means no relevant coupons."""
-    resp = await client.get("/coupons/relevant", headers=auth_headers)
+    resp = await client.get("/api/v1/coupons/relevant", headers=auth_headers)
     assert resp.status_code == 200
     assert resp.json() == []

tests/test_routes/test_prices.py

@@ -48,7 +48,7 @@ async def price_data(db_engine, auth_headers):
 
 @pytest.mark.asyncio
 async def test_price_trends(client, price_data):
-    resp = await client.get("/prices/trends", headers=price_data["headers"])
+    resp = await client.get("/api/v1/prices/trends", headers=price_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert len(data) >= 1
@@ -58,18 +58,22 @@ async def test_price_trends(client, price_data):
 
 @pytest.mark.asyncio
 async def test_price_trends_by_category(client, price_data):
-    resp = await client.get("/prices/trends?category=household", headers=price_data["headers"])
+    resp = await client.get(
+        "/api/v1/prices/trends?category=household", headers=price_data["headers"]
+    )
     assert resp.status_code == 200
     assert len(resp.json()) == 1
 
-    resp = await client.get("/prices/trends?category=nonexistent", headers=price_data["headers"])
+    resp = await client.get(
+        "/api/v1/prices/trends?category=nonexistent", headers=price_data["headers"]
+    )
     assert resp.status_code == 200
     assert len(resp.json()) == 0
 
 
 @pytest.mark.asyncio
 async def test_price_increases(client, price_data):
-    resp = await client.get("/prices/increases", headers=price_data["headers"])
+    resp = await client.get("/api/v1/prices/increases", headers=price_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert len(data) >= 1
@@ -82,7 +86,9 @@ async def test_price_increases(client, price_data):
 @pytest.mark.asyncio
 async def test_price_comparison(client, price_data):
     pid = str(price_data["product"].id)
-    resp = await client.get(f"/prices/comparison?product_ids={pid}", headers=price_data["headers"])
+    resp = await client.get(
+        f"/api/v1/prices/comparison?product_ids={pid}", headers=price_data["headers"]
+    )
     assert resp.status_code == 200
     data = resp.json()
     assert len(data) >= 1

tests/test_routes/test_products.py

@@ -49,7 +49,7 @@ async def product_data(db_engine, auth_headers):
 
 @pytest.mark.asyncio
 async def test_list_products(client, product_data):
-    resp = await client.get("/products", headers=product_data["headers"])
+    resp = await client.get("/api/v1/products", headers=product_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert len(data) >= 1
@@ -58,11 +58,11 @@ async def test_list_products(client, product_data):
 
 @pytest.mark.asyncio
 async def test_search_products(client, product_data):
-    resp = await client.get("/products?q=Cheerios", headers=product_data["headers"])
+    resp = await client.get("/api/v1/products?q=Cheerios", headers=product_data["headers"])
     assert resp.status_code == 200
     assert len(resp.json()) == 1
 
-    resp = await client.get("/products?q=nonexistent", headers=product_data["headers"])
+    resp = await client.get("/api/v1/products?q=nonexistent", headers=product_data["headers"])
     assert resp.status_code == 200
     assert len(resp.json()) == 0
 
@@ -70,7 +70,7 @@ async def test_search_products(client, product_data):
 @pytest.mark.asyncio
 async def test_get_product_detail(client, product_data):
     pid = str(product_data["product"].id)
-    resp = await client.get(f"/products/{pid}", headers=product_data["headers"])
+    resp = await client.get(f"/api/v1/products/{pid}", headers=product_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert data["name"] == "Cheerios 18oz"
@@ -80,14 +80,14 @@ async def test_get_product_detail(client, product_data):
 
 @pytest.mark.asyncio
 async def test_get_product_not_found(client, auth_headers):
-    resp = await client.get(f"/products/{uuid.uuid4()}", headers=auth_headers)
+    resp = await client.get(f"/api/v1/products/{uuid.uuid4()}", headers=auth_headers)
     assert resp.status_code == 404
 
 
 @pytest.mark.asyncio
 async def test_get_product_prices(client, product_data):
     pid = str(product_data["product"].id)
-    resp = await client.get(f"/products/{pid}/prices", headers=product_data["headers"])
+    resp = await client.get(f"/api/v1/products/{pid}/prices", headers=product_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert data["product_name"] == "Cheerios 18oz"

tests/test_routes/test_public.py

@@ -42,7 +42,7 @@ async def public_data(db_engine):
 @pytest.mark.asyncio
 async def test_public_trend(client, public_data):
     pid = str(public_data["product"].id)
-    resp = await client.get(f"/public/trends/{pid}")
+    resp = await client.get(f"/api/v1/public/trends/{pid}")
     assert resp.status_code == 200
     data = resp.json()
     assert data["product_name"] == "Skippy PB 16oz"
@@ -51,14 +51,14 @@ async def test_public_trend(client, public_data):
 
 @pytest.mark.asyncio
 async def test_public_trend_not_found(client):
-    resp = await client.get(f"/public/trends/{uuid.uuid4()}")
+    resp = await client.get(f"/api/v1/public/trends/{uuid.uuid4()}")
     assert resp.status_code == 404
 
 
 @pytest.mark.asyncio
 async def test_public_store_comparison(client, public_data):
     pid = str(public_data["product"].id)
-    resp = await client.get(f"/public/store-comparison?product_ids={pid}")
+    resp = await client.get(f"/api/v1/public/store-comparison?product_ids={pid}")
     assert resp.status_code == 200
     data = resp.json()
     assert len(data["products"]) == 1
@@ -66,7 +66,7 @@ async def test_public_store_comparison(client, public_data):
 
 @pytest.mark.asyncio
 async def test_public_inflation(client, public_data):
-    resp = await client.get("/public/inflation")
+    resp = await client.get("/api/v1/public/inflation")
     assert resp.status_code == 200
     data = resp.json()
     assert "categories" in data
@@ -75,7 +75,7 @@ async def test_public_inflation(client, public_data):
 
 @pytest.mark.asyncio
 async def test_trend_invalid_uuid(client):
-    resp = await client.get("/public/trends/not-a-uuid")
+    resp = await client.get("/api/v1/public/trends/not-a-uuid")
     assert resp.status_code == 422
     assert "detail" in resp.json()
     assert "stack" not in resp.json()
@@ -84,7 +84,7 @@ async def test_trend_invalid_uuid(client):
 @pytest.mark.asyncio
 async def test_trend_days_zero(client, public_data):
     pid = str(public_data["product"].id)
-    resp = await client.get(f"/public/trends/{pid}?days=0")
+    resp = await client.get(f"/api/v1/public/trends/{pid}?days=0")
     assert resp.status_code == 422
     assert "detail" in resp.json()
     assert "stack" not in resp.json()
@@ -93,7 +93,7 @@ async def test_trend_days_zero(client, public_data):
 @pytest.mark.asyncio
 async def test_trend_days_negative(client, public_data):
     pid = str(public_data["product"].id)
-    resp = await client.get(f"/public/trends/{pid}?days=-1")
+    resp = await client.get(f"/api/v1/public/trends/{pid}?days=-1")
     assert resp.status_code == 422
     assert "detail" in resp.json()
     assert "stack" not in resp.json()
@@ -102,7 +102,7 @@ async def test_trend_days_negative(client, public_data):
 @pytest.mark.asyncio
 async def test_trend_days_over_max(client, public_data):
     pid = str(public_data["product"].id)
-    resp = await client.get(f"/public/trends/{pid}?days=999")
+    resp = await client.get(f"/api/v1/public/trends/{pid}?days=999")
     assert resp.status_code == 422
     assert "detail" in resp.json()
     assert "stack" not in resp.json()
@@ -111,15 +111,15 @@ async def test_trend_days_over_max(client, public_data):
 @pytest.mark.asyncio
 async def test_trend_days_valid(client, public_data):
     pid = str(public_data["product"].id)
-    resp = await client.get(f"/public/trends/{pid}?days=30")
+    resp = await client.get(f"/api/v1/public/trends/{pid}?days=30")
     assert resp.status_code == 200
     assert "product_name" in resp.json()
 
 
 @pytest.mark.asyncio
 async def test_store_comparison_empty_list(client):
-    resp = await client.get("/public/store-comparison")
-    assert resp.status_code == 400
+    resp = await client.get("/api/v1/public/store-comparison")
+    assert resp.status_code == 422
     assert "detail" in resp.json()
 
 
@@ -127,7 +127,7 @@ async def test_store_comparison_empty_list(client):
 async def test_store_comparison_category_xss(client, public_data):
     pid = str(public_data["product"].id)
     resp = await client.get(
-        f"/public/store-comparison?product_ids={pid}&category=<script>alert(1)</script>"
+        f"/api/v1/public/store-comparison?product_ids={pid}&category=<script>alert(1)</script>"
     )
     assert resp.status_code == 422
     assert "detail" in resp.json()
@@ -137,7 +137,9 @@ async def test_store_comparison_category_xss(client, public_data):
 @pytest.mark.asyncio
 async def test_store_comparison_category_sql_injection(client, public_data):
     pid = str(public_data["product"].id)
-    resp = await client.get(f"/public/store-comparison?product_ids={pid}&category='; DROP TABLE--")
+    resp = await client.get(
+        f"/api/v1/public/store-comparison?product_ids={pid}&category='; DROP TABLE--"
+    )
     assert resp.status_code == 422
     assert "detail" in resp.json()
     assert "stack" not in resp.json()
@@ -145,7 +147,7 @@ async def test_store_comparison_category_sql_injection(client, public_data):
 
 @pytest.mark.asyncio
 async def test_inflation_invalid_period(client, public_data):
-    resp = await client.get("/public/inflation?period=10years")
+    resp = await client.get("/api/v1/public/inflation?period=10years")
     assert resp.status_code == 422
     assert "detail" in resp.json()
     assert "stack" not in resp.json()
@@ -154,14 +156,14 @@ async def test_inflation_invalid_period(client, public_data):
 @pytest.mark.asyncio
 async def test_inflation_valid_periods(client, public_data):
     for period in ["all-time", "1y", "6m", "3m", "1m"]:
-        resp = await client.get(f"/public/inflation?period={period}")
+        resp = await client.get(f"/api/v1/public/inflation?period={period}")
         assert resp.status_code == 200, f"period={period} failed"
 
 
 @pytest.mark.asyncio
 async def test_inflation_category_too_long(client, public_data):
     long_category = "x" * 200
-    resp = await client.get(f"/public/inflation?category={long_category}")
+    resp = await client.get(f"/api/v1/public/inflation?category={long_category}")
     assert resp.status_code == 422
     assert "detail" in resp.json()
     assert "stack" not in resp.json()

tests/test_routes/test_purchases.py

@@ -80,7 +80,7 @@ async def purchase_data(db_engine):
 
 @pytest.mark.asyncio
 async def test_list_purchases(client, purchase_data):
-    resp = await client.get("/purchases", headers=purchase_data["headers"])
+    resp = await client.get("/api/v1/purchases", headers=purchase_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert len(data) == 1
@@ -91,7 +91,7 @@ async def test_list_purchases(client, purchase_data):
 @pytest.mark.asyncio
 async def test_get_purchase_detail(client, purchase_data):
     pid = str(purchase_data["purchase"].id)
-    resp = await client.get(f"/purchases/{pid}", headers=purchase_data["headers"])
+    resp = await client.get(f"/api/v1/purchases/{pid}", headers=purchase_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert len(data["line_items"]) == 1
@@ -100,13 +100,13 @@ async def test_get_purchase_detail(client, purchase_data):
 
 @pytest.mark.asyncio
 async def test_get_purchase_not_found(client, auth_headers):
-    resp = await client.get(f"/purchases/{uuid.uuid4()}", headers=auth_headers)
+    resp = await client.get(f"/api/v1/purchases/{uuid.uuid4()}", headers=auth_headers)
     assert resp.status_code == 404
 
 
 @pytest.mark.asyncio
 async def test_purchase_stats(client, purchase_data):
-    resp = await client.get("/purchases/stats", headers=purchase_data["headers"])
+    resp = await client.get("/api/v1/purchases/stats", headers=purchase_data["headers"])
     assert resp.status_code == 200
     data = resp.json()
     assert data["total_spent"] == 42.50

tests/test_routes/test_stores.py

@@ -21,7 +21,7 @@ async def seeded_store(db_engine):
 
 @pytest.mark.asyncio
 async def test_list_stores(client, seeded_store):
-    resp = await client.get("/stores")
+    resp = await client.get("/api/v1/stores")
     assert resp.status_code == 200
     data = resp.json()
     assert len(data) >= 1
@@ -30,7 +30,7 @@ async def test_list_stores(client, seeded_store):
 
 @pytest.mark.asyncio
 async def test_list_user_stores_empty(client, auth_headers):
-    resp = await client.get("/me/stores", headers=auth_headers)
+    resp = await client.get("/api/v1/me/stores", headers=auth_headers)
     assert resp.status_code == 200
     assert resp.json() == []
 
@@ -39,7 +39,7 @@ async def test_list_user_stores_empty(client, auth_headers):
 async def test_connect_and_disconnect_store(client, auth_headers, seeded_store):
     # Connect
     resp = await client.post(
-        "/me/stores/meijer/connect",
+        "/api/v1/me/stores/meijer/connect",
         headers=auth_headers,
         json={"credentials": None},
     )
@@ -47,23 +47,23 @@ async def test_connect_and_disconnect_store(client, auth_headers, seeded_store):
     assert resp.json()["connected"] is True
 
     # List should show connected
-    resp = await client.get("/me/stores", headers=auth_headers)
+    resp = await client.get("/api/v1/me/stores", headers=auth_headers)
     assert resp.status_code == 200
     assert len(resp.json()) == 1
 
     # Disconnect
-    resp = await client.delete("/me/stores/meijer", headers=auth_headers)
+    resp = await client.delete("/api/v1/me/stores/meijer", headers=auth_headers)
     assert resp.status_code == 204
 
     # List should be empty again
-    resp = await client.get("/me/stores", headers=auth_headers)
+    resp = await client.get("/api/v1/me/stores", headers=auth_headers)
     assert resp.json() == []
 
 
 @pytest.mark.asyncio
 async def test_connect_nonexistent_store(client, auth_headers):
     resp = await client.post(
-        "/me/stores/nonexistent/connect",
+        "/api/v1/me/stores/nonexistent/connect",
         headers=auth_headers,
         json={},
     )
@@ -72,6 +72,6 @@ async def test_connect_nonexistent_store(client, auth_headers):
 
 @pytest.mark.asyncio
 async def test_connect_duplicate_store(client, auth_headers, seeded_store):
-    await client.post("/me/stores/meijer/connect", headers=auth_headers, json={})
-    resp = await client.post("/me/stores/meijer/connect", headers=auth_headers, json={})
+    await client.post("/api/v1/me/stores/meijer/connect", headers=auth_headers, json={})
+    resp = await client.post("/api/v1/me/stores/meijer/connect", headers=auth_headers, json={})
     assert resp.status_code == 409