V8: Typed, authed, org-scoped API serving the compliance table

[ckrough]

Complexity: M

Scope

Typed, authed, org-scoped API serving the compliance data:

• FastAPI routes with response_model (OpenAPI 3.1 at /api/docs) returning the latest sync-status table for an org (animal x channel x hop, status, versions, diff pointer) and a per-animal detail route.
• Supabase Auth; records org-scoped via RLS.
• cors_origins from config.

No LLM in this service, so no AI Gateway / Promptfoo; Schemathesis fuzz stands in.

Dependencies

• Blocked by: V6: Diff / compliance engine #308 (the data) and V1: Scaffold services/listings/ to the tech-stack standard #303 (auth/config scaffold).
• Blocks: V9: Sync-status dashboard route in apps/stacker #311.

Acceptance criteria

• The compliance-table route with a valid token returns 200 and a payload validating against its response_model (a 200 through response_model proves validation).
• Unauthenticated request returns 401.
• A caller in org A cannot read org B's rows through the API (integration test).
• Preflight from a non-allowed origin is rejected; from an allowed origin, it is permitted (CORS test).
• A Schemathesis run against the OpenAPI spec produces no 5xx on generated inputs.

---

ADR: docs/adr/0033-listing-sync-verification.md. Epic: #302.
Auth surface: high-risk, security.