fix: address project audit gaps

backend/internal/httpx/router.go

@@ -7,7 +7,11 @@ import (
 	"senlinai-agent/backend/internal/config"
 )
 
-func NewRouter(cfg config.Config) *gin.Engine {
+type RouteRegistrar interface {
+	Register(router gin.IRouter)
+}
+
+func NewRouter(cfg config.Config, registrars ...RouteRegistrar) *gin.Engine {
 	if cfg.Env == "test" {
 		gin.SetMode(gin.TestMode)
 	}
@@ -18,6 +22,10 @@ func NewRouter(cfg config.Config) *gin.Engine {
 	router.GET("/healthz", func(c *gin.Context) {
 		c.JSON(http.StatusOK, gin.H{"status": "ok"})
 	})
+	api := router.Group("/api")
+	for _, registrar := range registrars {
+		registrar.Register(api)
+	}
 
 	return router
 }

backend/internal/httpx/router_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http/httptest"
 	"testing"
 
+	"github.com/gin-gonic/gin"
 	"github.com/stretchr/testify/require"
 	"senlinai-agent/backend/internal/config"
 )
@@ -19,3 +20,22 @@ func TestHealthz(t *testing.T) {
 	require.Equal(t, http.StatusOK, rec.Code)
 	require.JSONEq(t, `{"status":"ok"}`, rec.Body.String())
 }
+
+func TestNewRouterRegistersFeatureRoutesUnderAPI(t *testing.T) {
+	router := NewRouter(config.Config{Env: "test"}, testRegistrar{})
+	req := httptest.NewRequest(http.MethodGet, "/api/ping", nil)
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	require.JSONEq(t, `{"pong":true}`, rec.Body.String())
+}
+
+type testRegistrar struct{}
+
+func (testRegistrar) Register(router gin.IRouter) {
+	router.GET("/ping", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"pong": true})
+	})
+}