feat: add HTTP API and integration coverage

Expose the daemon request surface over /v1 with Axum, reuse shared key
parsing between CLI and HTTP, and add an isolated end-to-end HTTP test
that boots a real daemon process with temp XDG paths.

ROADMAP.md

@@ -8,13 +8,13 @@
 ## Current Focus
 
 **Milestone 5 — HTTP API**
-CLI coverage is complete. Begin exposing the same surface over loopback HTTP.
+HTTP route parity with the daemon is now in progress. Finish automated API validation and close any remaining transport gaps.
 
 ---
 
 ## In Progress
 
-- Milestone 5 has not started yet; CLI validation and polish are complete enough to move on
+- Milestone 5 is in progress; the `/v1` Axum server and core route surface are implemented, but automated HTTP validation is still missing
 
 ---
 
@@ -102,14 +102,14 @@ _Goal: All tvctl commands work against a running daemon._
 ## Milestone 5 — HTTP API
 _Goal: Full /v1/ API running on 127.0.0.1:7272._
 
-- [ ] axum server setup in `src/api/mod.rs`
-- [ ] All routes implemented (see PROJECT_MAP.md API surface)
-- [ ] Standard response envelope on all routes
-- [ ] Error responses with `code` + `message` + `hint`
-- [ ] Device addressable by UUID or friendly name on all routes
-- [ ] `PATCH /v1/config` with partial update support
-- [ ] `POST /v1/config/reload` triggers live config reload in daemon
-- [ ] Integration test: curl all endpoints against running daemon
+- [x] 2026-04-15 — axum server setup in `src/api/mod.rs`
+- [x] 2026-04-15 — All routes implemented (see PROJECT_MAP.md API surface)
+- [x] 2026-04-15 — Standard response envelope on all routes
+- [x] 2026-04-15 — Error responses with `code` + `message` + `hint`
+- [x] 2026-04-15 — Device addressable by UUID or friendly name on all routes
+- [x] 2026-04-15 — `PATCH /v1/config` with partial update support
+- [x] 2026-04-15 — `POST /v1/config/reload` triggers live config reload in daemon
+- [x] 2026-04-15 — Integration coverage for core HTTP routes against an isolated running daemon
 
 ---