Add JSON REST API for MCP integration

- Add /api/v1 namespace with Bearer token auth (PINCHFLAT_API_TOKEN env var)
- API controllers for sources, media items, media profiles, settings, tasks
- Support for all source actions: create, update, delete, force_download_pending,
  force_redownload, force_index, force_metadata_refresh, sync_files_on_disk
- Media item endpoints: list, show, search, force_download, update, delete
- Media profile CRUD endpoints
- Settings show/update and app_info endpoints
- Task listing endpoints
- Add Jason.Encoder for Task schema
- Comprehensive test suite for all API endpoints
- Gitea Actions CI workflow (runs existing checks + API-specific tests)
- API documentation in docs/API.md

test/pinchflat_web/api_auth_plug_test.exs

@@ -0,0 +1,65 @@
+defmodule PinchflatWeb.ApiAuthPlugTest do
+  use PinchflatWeb.ConnCase
+
+  import Pinchflat.ProfilesFixtures
+
+  setup do
+    # Ensure api_token is not set by default in tests
+    Application.put_env(:pinchflat, :api_token, nil)
+    :ok
+  end
+
+  describe "when no api_token is configured" do
+    test "allows access without Authorization header", %{conn: conn} do
+      conn = get(conn, ~p"/api/v1/media_profiles")
+      assert %{status: 200} = conn
+    end
+  end
+
+  describe "when api_token is configured" do
+    setup do
+      Application.put_env(:pinchflat, :api_token, "secret-token-123")
+      on_exit(fn -> Application.put_env(:pinchflat, :api_token, nil) end)
+      :ok
+    end
+
+    test "allows access with correct Bearer token", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("authorization", "Bearer secret-token-123")
+        |> get(~p"/api/v1/media_profiles")
+
+      assert %{status: 200} = conn
+    end
+
+    test "returns 401 without Authorization header", %{conn: conn} do
+      conn = get(conn, ~p"/api/v1/media_profiles")
+
+      assert %{status: 401} = conn
+      assert json_response(conn, 401)["errors"]["detail"] == "Unauthorized"
+    end
+
+    test "returns 401 with incorrect token", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("authorization", "Bearer wrong-token")
+        |> get(~p"/api/v1/media_profiles")
+
+      assert %{status: 401} = conn
+    end
+
+    test "returns 401 with malformed Authorization header", %{conn: conn} do
+      conn =
+        conn
+        |> put_req_header("authorization", "secret-token-123")
+        |> get(~p"/api/v1/media_profiles")
+
+      assert %{status: 401} = conn
+    end
+
+    test "healthcheck endpoint does not require auth", %{conn: conn} do
+      conn = get(conn, ~p"/healthcheck")
+      assert %{status: 200} = conn
+    end
+  end
+end