feat: auto-discover API endpoints for API Reference page

[mmcintosh]

Description

Replace the static hardcoded array of 27 endpoints on the API Reference page (/admin/api-reference) with runtime auto-discovery using Hono's inspectRoutes(). The page now automatically shows every registered API route without requiring manual updates when new routes are added.

The old approach required developers to manually add each new endpoint to a static array in admin-api-reference.ts — which clearly drifted, as 5 entire categories were missing. This PR makes the page self-healing: any route registered in app.ts is automatically discovered and displayed.

Changes

• New service: packages/core/src/services/route-metadata.ts

  • Uses inspectRoutes() from hono/dev to discover all registered routes at runtime
  • Whitelist-based filtering ensures only API endpoints are shown (not admin HTML pages, auth forms, favicon, etc.)
  • Metadata registry provides descriptions, auth requirements, and categories for known routes
  • Routes without metadata appear automatically with an "Auto-discovered" badge and inferred category/auth
  • Result cached at module level (computed once per worker instance — no per-request cost)

• packages/core/src/app.ts (+4 lines)

  • Import setAppInstance from route-metadata service
  • Call setAppInstance(app) after all routes are registered, before the 404 handler

• packages/core/src/services/index.ts (+9 lines)

  • Export new route-metadata service (buildRouteList, setAppInstance, getAppInstance, CATEGORY_INFO, RouteMetadata)

• packages/core/src/routes/admin-api-reference.ts (rewritten, 279 → ~80 lines)

  • Removed the entire 200-line static apiEndpoints array
  • Route handler now calls buildRouteList(getAppInstance()) for live discovery

• packages/core/src/templates/pages/admin-api-reference.template.ts (updated)

  • Category dropdown built dynamically from discovered data (not hardcoded 5 categories)
  • Three auth badge states: Auth (amber), Public (green), Unknown (gray)
  • "Auto-discovered" badge for routes without metadata entries
  • Stats bar expanded to 5 cards: Total, Public, Protected, Categories, Undocumented
  • Category icons and descriptions sourced from CATEGORY_INFO constant

Testing

Manual Verification

• Build passes (npm run build in packages/core)
• Lint passes (pre-commit hook runs ESLint)
• All existing endpoint descriptions preserved identically
• Search, method filter, and category filter all work correctly
• Copy-to-clipboard on endpoint paths works
• Dynamic category dropdown reflects actual discovered categories

Unit Tests

• All unit tests passing (no new tests needed — admin-only UI with no new API contracts)

E2E Tests

• All E2E tests passing (CI green — 3 shards, all passed)

Key Property

The number of endpoints shown on the page will vary by deployment — inspectRoutes() only discovers what's actually registered. On upstream (which may have fewer plugins), the page simply shows fewer endpoints. Extra metadata entries for routes that don't exist are harmless unused lookups.

Screenshots/Videos

Checklist

• Code follows project conventions
• Tests added/updated and passing
• Type checking passes
• No console errors or warnings
• Documentation updated (if needed)