feat: auto fix api v2 version to support session token

[ravverma]

Summary

Adds autofixSuggestionsV2 endpoint that reads the promise token from the promise_token cookie instead of creating it from the Authorization header via IMS.

• New endpoint: PATCH /sites/:siteId/opportunities/:opportunityId/suggestions/auto-fix-v2
• Promise token: Read from promise_token cookie; returns 400 if missing or empty
• Deprecation: Original autofixSuggestions and /suggestions/auto-fix marked deprecated

Files changed

File	Change
src/controllers/suggestions.js	Added autofixSuggestionsV2, deprecated autofixSuggestions
src/routes/index.js	Added route for auto-fix-v2
docs/openapi/api.yaml	Added path for auto-fix-v2
docs/openapi/site-opportunities.yaml	Deprecated v1 spec, added v2 spec
test/controllers/suggestions.test.js	20 tests for autofixSuggestionsV2
test/routes/index.test.js	Added auto-fix-v2 to expected routes

Test plan

• Cookie validation: missing, empty, absent → 400
• Happy path: grouped (alt-text) and ungrouped (broken-backlinks)
• Validation: siteId, opportunityId, suggestionIds, variations, action
• Error paths: 404 (site/opportunity), 403 (access), 400 (handler disabled)
• Partial success: suggestion not found, not in NEW status
• No valid suggestions: bulkUpdateStatus not called

[github-actions]

This PR will trigger a minor release when merged.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!