/api/status, for Homepage's dashboard (#67)

The iPX tile on Homepage was a bare link: nothing in ipx gave a summary a
customapi widget could read. /api/status serves what `ipx status` prints
(feeds, items pending, files downloaded), from the same function the
control socket answers with, plus the version. It sits behind sign-in
like the rest of /api; Homepage sends the shared [web] token as the
ipx_token cookie.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/ui/app.spec.js

@@ -1197,6 +1197,17 @@ test('the logo is the dark one in dark mode and the light one in light mode', as
   await page.evaluate(() => setTheme('modern', 'dark'));
 });
 
+test('/api/status gives a dashboard the counts, with the shared token as a cookie', async ({ page }) => {
+  // As Homepage's customapi widget asks: no session, only the token in a Cookie header.
+  const r = await page.request.get('/api/status', { headers: { cookie: `ipx_token=${TOKEN}` } });
+  expect(r.status()).toBe(200);
+  const s = await r.json();
+  for (const k of ['feeds', 'pending', 'downloaded']) expect(typeof s[k], k).toBe('number');
+  expect(s.version).toMatch(/^\d+\.\d+\.\d+/);
+  const none = await page.request.get('/api/status', { headers: { cookie: '' } });
+  expect(none.status()).toBe(401);
+});
+
 test('the favicon is the logo, square, from both pages', async ({ page }) => {
   await page.evaluate(() => setTheme('modern', 'light'));
   await expect(page.locator('#favicon')).toHaveAttribute('href', /^\/favicon\.png\?v=[0-9a-f]{12}$/);