Wire landed MistKit API endpoints into the MistDemo web app (MistKit-server mode)

[leogdion]

Goal

Wire the CloudKit Web Services endpoints whose MistKit Swift wrappers already exist into the MistDemo web app (mistdemo web, Hummingbird / MistKit-server mode), replacing the 501 "pending" stubs with real handlers.

This is the follow-up to #370, which scaffolded these as 501 stubs (WebServer.addUnwiredLandedEndpoints). Only the /api/* route wiring is outstanding — the underlying CloudKitService methods all shipped (#215 / #45 / #47 / #48 / #367). CloudKit JS mode already implements every one of these in the browser, so wiring the MistKit side restores parity between the two modes (#370's "exercisable in both modes" criterion).

Endpoints to wire

Each row's MistKit wrapper already exists in Sources/MistKit/CloudKitService/:

Verb	Route	MistKit method
POST	records/lookup	lookupRecords()
POST	records/changes	fetchRecordChanges() / fetchAllRecordChanges()
POST	zones/list	listZones()
POST	zones/lookup	lookupZones()
POST	zones/changes	fetchZoneChanges()
GET	users/caller	fetchCaller()
POST	users/discover	discoverUserIdentities()
POST	users/lookup/email	lookupUsersByEmail()
POST	users/lookup/id	lookupUsersByRecordName()

These are the exact routes currently registered as 501 stubs in Examples/MistDemo/Sources/MistDemoKit/Server/WebServer+Pending.swift (addUnwiredLandedEndpoints, tracked here).

Out of scope: records/resolve (#41) — it has no MistKit wrapper yet (CloudKitService has no resolveRecords), so it stays a 501 stub in addPendingEndpoints until #41 lands.

Implementation pattern

Follow the already-wired routes (WebServer+Zones.swift, WebServer+Assets.swift, WebServer+CRUD.swift) for each endpoint:

1. Backend method — add a webXxx(...) method to the WebBackend protocol (Server/WebBackend.swift) and implement it in Server/CloudKitService+WebBackend.swift as a thin forward to the existing CloudKitService method.
2. Route — add a real Hummingbird handler in a dedicated WebServer+*.swift extension (e.g. WebServer+Records.swift, WebServer+Users.swift, extend WebServer+Zones.swift): auth guard via tokenStore.currentToken → request.decode(as: WebRequests.…) → backend.webXxx(...) → encode a WebResponse.… via WebJSON.encoder(), all inside Self.runOperation { … }.
3. DTOs — add request/response shapes under Server/WebRequests*.swift / WebResponse.
4. De-stub — remove the corresponding (verb, path) entry from addUnwiredLandedEndpoints in WebServer+Pending.swift (and update its doc comment's remaining-pending list).
5. Front-end — wire the route into the browser MistKit-mode panel so it's exercisable from the page (mirror the existing CloudKit JS-mode calls).

Tests

Mirror Examples/MistDemo/Tests/MistDemoTests/Server/WebServerTests+Assets.swift: for each route, a forwarding test (MockBackend records the call) plus a 401 unauthorized test when no token is present. Extend MockBackend / MockBackend+Calls.swift with the new webXxx methods.

Done when

• All 9 routes serve real responses in MistKit-server mode (no 501s).
• addUnwiredLandedEndpoints is empty/removed; WebServer+Pending only lists records/resolve (Fetching Record Information (records/resolve) #41).
• Each route is reachable and exercisable from the web UI in MistKit mode, at parity with CloudKit JS mode.
• swift build / swift test / ./Scripts/lint.sh clean.