test: add API route error-handling consistency tests (#1118)

[sw-factory-automations]

Closes #1118

What

Adds structural convention tests that scan all API route files and verify each route handler that performs Supabase mutations also uses the standard error classification utilities. This catches the "forgot to add the check in the new endpoint" pattern that caused repeated Sentry noise bugs (#1004, #1013, #1083, #1084, #1114).

How

New test file src/lib/sentry/api-route-consistency.test.ts with 6 tests:

1. Finds API route files — sanity check that the scanner discovers routes
2. Mutation routes import capture utilities — routes with .insert()/.update()/.delete()/.upsert() or .rpc() must import captureSupabaseError or captureApiError
3. Table mutation routes handle FK violations — routes with .insert()/.update()/.delete() must import isForeignKeyViolationError or captureSupabaseError (which classifies FK violations internally)
4. Catch blocks use Sentry capture — no bare console.error in catch blocks; must use captureApiError or captureSupabaseError
5. Supabase routes have error capture — routes using .from() or .rpc() must have catch blocks with Sentry capture
6. Allowlist hygiene — allowlist entries must reference existing files (prevents stale entries)

Allowlist mechanism included for routes that intentionally skip checks (currently only health/route.ts which uses raw fetch without the Supabase client).

Follows the same file-scanning pattern as the existing sentry.test.ts bare-catch scanner.

Testing

• pnpm lint — no new warnings
• pnpm typecheck — passes
• pnpm test — 143 files, 1918 tests all passing
• All 6 new tests pass against the current codebase (all existing routes are compliant)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
memo	Ready	Preview, Comment	May 16, 2026 10:07am

[sw-factory-automations]

✅ Post-merge verification skipped — test: PR does not affect the live app (no runtime, UI, or API changes).

[sw-factory-automations]

✅ UI verification skipped — no UI files changed. This PR only adds test files and updates .agents/quality.md.