[Fix] Unify API route auth guards, add database indexes, extract shared utilities, and add API client retry

[JunchenMeteor]

Summary

• Add guardApiRequest + requireApiUser to 6 previously unprotected API routes (summary, session POST/PATCH/DELETE, session/sync, history, turns, sessions/[id]/turns)
• Add guardApiRequest (client header + rate limit) to 3 public catalog endpoints (scenarios, accents, asr/providers)
• Add Supabase migration 011_add_indexes.sql with 6 secondary indexes for common query patterns
• Extract normalizeLocale to packages/shared/src/locale.ts (was duplicated in 3 files)
• Extract requireEnv to apps/web/lib/server/env.ts (was duplicated in 5 provider files)
• Extract sleep to packages/shared/src/locale.ts (was duplicated in 3 mock files)
• Add exponential backoff retry to packages/api-client (default 2 retries, 500ms base delay, retries on 5xx/429/timeout/network errors only)
• Make Xunfei trial voice expiry configurable via XUNFEI_TRIAL_VOICE_EXPIRES_AT env var with fallback
• Add E2E test skeleton e2e/session.spec.ts covering auth guard integration and page navigation

Test Plan

• npx vitest run — 118 tests pass (13 files), including 2 new retry tests
• npx tsc --noEmit — type check passes with zero errors
• API guard integration verified: protected endpoints return 401 without auth, public endpoints return 403 without client header

Closes #297

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
meteorvoice	Ready	Preview, Comment	Jun 19, 2026 2:59am