Snaglist Backend API v1

Endpoints:
- GET /health - Health check

Authentication:
- POST /api/v1/auth/apple - Sign in with Apple
- POST /api/v1/auth/magic-link/request - Send a passwordless sign-in email (PM)
- POST /api/v1/auth/magic-link/verify - Exchange a magic-link token for a JWT
- GET /api/v1/auth/recognise?email= - Check if an email maps to a known account
- GET /auth/:token - Magic-link universal-link landing/fallback page (web)

Magic Links:
- POST /api/v1/magic-links/preview - Create an unsent preview link (auth required)
- GET /preview/:token - View an unsent preview link (submissions disabled)
- GET /api/v1/magic-links/:linkId/validate - Validate a magic link token
- POST /api/v1/magic-links/:linkId/verify-pin - Verify PIN for magic link
- POST /api/v1/magic-links - Create a new magic link (auth required)
- GET /api/v1/magic-links - List your magic links (auth required)
- DELETE /api/v1/magic-links/:linkId - Revoke a magic link (auth required)
- GET /api/v1/magic-links/:linkId/analytics - Get magic link analytics (auth required)
- GET /api/v1/magic-links/:linkId/pdf - Download PDF report of snags
- GET /api/v1/magic-links/:linkId/qr - Generate QR code image (PNG)
- POST /api/v1/magic-links/:linkId/send - Record a send + enforce tier allowance (auth required)
- GET /api/v1/users/me/usage - Magic-link allowance / tier counters (auth required)
- POST /api/v1/magic-links/sync - Sync magic link from iOS app (auth required)
- POST /api/v1/magic-links/:linkId/report - Sync report data (auth required)
- POST /api/v1/magic-links/:linkId/photos - Upload synced photo (auth required)
- POST /api/v1/magic-links/:linkId/drawings - Upload synced drawing (auth required)

Team Invites:
- GET /api/v1/team-invites/:inviteId/validate - Validate a team invite token
- POST /api/v1/team-invites - Create a new team invite (auth required)
- GET /api/v1/team-invites/pending - List pending invites (auth required)
- POST /api/v1/team-invites/:inviteId/accept - Accept a team invite (auth required)
- POST /api/v1/team-invites/:inviteId/decline - Decline a team invite (auth required)
- DELETE /api/v1/team-invites/:inviteId - Revoke a team invite (auth required)

Approvals:
- GET /api/v1/approvals/pending - List snags awaiting approval (auth required)
- POST /api/v1/approvals/:snagId/approve - Approve a submitted snag (auth required)
- POST /api/v1/approvals/:snagId/send-back - Send a snag back with a reason (auth required)

Completions:
- POST /api/v1/magic-links/:linkId/snags/:snagId/complete - Submit completion (magic link)
- GET /api/v1/completions/pending - List pending completions (auth required)
- GET /api/v1/completions/:completionId - Get completion details (auth required)
- POST /api/v1/completions/:completionId/approve - Approve completion (auth required)
- POST /api/v1/completions/:completionId/reject - Reject completion (auth required)

Snags:
- GET /api/v1/magic-links/:linkId/snags - List snags for a magic link
- GET /api/v1/snags/:snagId/completions - List all completions for a snag (auth required)

Uploads:
- POST /api/v1/uploads/photo - Upload a photo (multipart form data)

Analytics:
- POST /api/v1/events - Batch analytics events (auth optional; see ANALYTICS_EVENTS.md)
- POST /api/v1/diagnostics - MetricKit diagnostic payloads (auth optional)

Config:
- GET /api/v1/config/feature-flags - Remote feature flags (auth optional)

Devices:
- POST /api/v1/devices/register - Register device for push notifications (auth required)
- DELETE /api/v1/devices/unregister - Unregister device token (auth required)