docs(api): add route namespace guide to API v2 CLAUDE.md

Document the namespace separation (audio/:id for clips, system/audio/*
for management, streams/* for live data) and the /api/v2/audio/:id
wildcard collision risk. Also add anonymization requirement for public
source metadata endpoints.

Author: tphakala

internal/api/v2/CLAUDE.md

@@ -4,7 +4,7 @@
 
 **ALWAYS read `internal/api/v2/README.md` first** - it contains:
 
-- Complete list of all 75 API endpoints
+- Complete list of all API endpoints
 - Route registration patterns
 - Authentication requirements
 - Best practices and security guidelines
@@ -39,6 +39,21 @@
 - Protected endpoints: `c.getEffectiveAuthMiddleware()`
 - Rate-limited streams: `middleware.RateLimiterWithConfig(config)`
 
+### Route Namespace Guide
+
+The API uses distinct namespaces. Adding endpoints to the wrong namespace causes route collisions.
+
+| Namespace | Purpose | Registration | Example |
+|---|---|---|---|
+| `/audio/:id` | Detection audio clips by numeric note ID | `c.Echo.GET(...)` | `ServeAudioByID` |
+| `/system/audio/*` | Audio device/source management (protected) | `protectedGroup.Group("/audio")` | `GetAudioDevices`, `ListAudioSources` |
+| `/streams/*` | Live streaming, SSE, source listing (public) | `c.Group.GET("/streams/...")` | `StreamAudioLevel`, `ListStreamSources` |
+| `/media/*` | Static media files (images, spectrograms) | `c.Group.GET("/media/...")` | `ServeSpectrogram` |
+
+**WARNING:** `GET /api/v2/audio/:id` is registered directly on `c.Echo` (not `c.Group`) and catches ALL paths under `/api/v2/audio/*`. Any non-numeric path like `/api/v2/audio/sources` returns 400. Never add new endpoints under `/api/v2/audio/` unless they use a numeric `:id` parameter.
+
+**Public endpoints that expose source metadata** must anonymize display names for unauthenticated clients using `c.getAnonymizedSourceName()`, matching the behavior of `StreamAudioLevel`.
+
 ### Critical Rules
 
 - **Never duplicate existing endpoints** - check README.md first