REST API Contract-First Migration (follow-up to SI-33 PoC)

[josecelano]

Goal

Progressively migrate all remaining REST API contexts (health_check, whitelist, auth_key, stats) from direct tracker-internal wiring to the contract-first layered architecture (protocol → application → runtime-adapter → axum transport), following the pattern validated by #1930 (SI-33) PoC.

Why This Is Needed

#1930 validated the contract-first architecture with a single endpoint (torrent detail). The remaining contexts still have the old coupling:

• Axum handlers call tracker internals directly (tracker-core, udp-core, http-core, udp-server).
• DTO/response types are defined locally in the Axum server, not in rest-api-protocol.
• No port traits or use-case services exist for these contexts.
• The forbidden dependency edges (axum-rest-api-server → tracker-core etc.) still exist for non-torrent contexts.

Migrating all contexts to the new architecture will:

• Allow removing 7+ internal crate dependencies from axum-rest-api-server.
• Make each context testable at the application layer without Axum.
• Provide a clear path toward a tracker-agnostic REST API standard.
• Complete the architectural vision started by SI-33.

Sub-issues

• SI-1: Migrate health_check context
• SI-2: Migrate whitelist context
• SI-3: Migrate auth_key context
• SI-4: Migrate stats context
• SI-5: Deprecate rest-api-core and remove from workspace
• SI-6: Introduce ApiClient — a high-level typed client over protocol DTOs

Migration Order

1. SI-1 — health_check (small, no tracker deps)
2. SI-2 — whitelist (medium, only tracker-core)
3. SI-3 — auth_key (medium, tracker-core + clock)
4. SI-4 — stats (large, 5+ crate deps, 28-field DTO, Prometheus)
5. SI-5 — deprecate rest-api-core (cleanup after all contexts migrated)
6. SI-6 — introduce ApiClient (typed wrapper over ApiHttpClient)

Success Criteria

• All 10 non-torrent Axum handler functions dispatch through application use-case services.
• All response DTOs live in rest-api-protocol; none are defined locally in Axum server.
• All direct tracker-core, udp-core, http-core, udp-server, rest-api-core, swarm-coordination-registry imports are removed from axum-rest-api-server.
• deny.toml layer bans enforce the new dependency rules.
• Pre-commit and pre-push checks pass.
• Integration tests continue to pass without behavioural changes.