- /api (v1) answers 410 API_V1_REMOVED, except provider webhooks
(/api/webhooks/*, /api/whatsapp/webhook) and links in sent messages
(308s, one-click POST). 43 v1 route files and deprecation.ts removed;
/docs redirects to /docs/v2; API_DOCUMENTATION.md points there.
- Read-only and impersonation lists name v2 paths only. The campus
scope route test now runs over v2 routes (v2CampusScope.test.ts).
- Passwords hashed with Argon2id (@node-rs/argon2); bcrypt hashes still
sign in and are re-hashed at the next sign-in.
- e2e on /api/v2 only (v2() helper); Playwright waits on /api/v2.
- MIGRATING-TO-2.md with the full v1 -> v2 table.
- Two documented response shapes corrected.
Backend 690 tests and e2e 102/102 (PayFast sandbox skipped) pass.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
joshuaandClaude Opus 5.5
9913a13f70