Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/httpapi/sales_handlers_test.go

@@ -0,0 +1,43 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/alexedwards/scs/v2"
+	"github.com/descrybe/descrybe-v2/apps/api/internal/config"
+)
+
+func TestRouterSalesRoutesMounted(t *testing.T) {
+	t.Parallel()
+	sm := scs.New()
+	sm.Cookie.Name = "descrybe_session"
+	s := &Server{
+		Config: config.Config{
+			CSRFCookieName: "descrybe_csrf",
+			WebOrigin:      "http://localhost:5173",
+		},
+		Sessions: sm,
+	}
+	h := s.Router()
+
+	// CSRF rejects anonymous POST without token.
+	contact := httptest.NewRecorder()
+	h.ServeHTTP(contact, httptest.NewRequest(http.MethodPost, "/api/sales/contact", nil))
+	if contact.Code == http.StatusNotFound {
+		t.Fatal("POST /api/sales/contact not mounted")
+	}
+	if contact.Code != http.StatusForbidden {
+		t.Fatalf("contact status=%d want 403 body=%s", contact.Code, contact.Body.String())
+	}
+
+	unauth := httptest.NewRecorder()
+	h.ServeHTTP(unauth, httptest.NewRequest(http.MethodGet, "/api/admin/sales/leads", nil))
+	if unauth.Code == http.StatusNotFound {
+		t.Fatal("GET /api/admin/sales/leads not mounted")
+	}
+	if unauth.Code != http.StatusUnauthorized {
+		t.Fatalf("admin leads status=%d want 401 body=%s", unauth.Code, unauth.Body.String())
+	}
+}