Migrate remaining APIs to Huma (fort scan draft + tier 3/4)

[jfberry]

Stacked on #368 (feat/huma-pokemon-v2-v3-scan) — it reuses that PR's Huma infrastructure (ApiLatLon, setupHumaAPI, the golbatSecret scheme, goccy serializer, body logger). Review/merge #368 first; this targets that branch and should be retargeted to main once #368 lands.

Summary

Migrates ~18 remaining /api endpoints from gin to Huma, so the whole API is documented in OpenAPI / browsable at /docs.

• Fort scan (/api/{gym,pokestop,station,fort}/scan) — served via Huma with a Draft badge (Stoplight x-badges), fort_in_memory 503 gating, and the int8/int16 fort DNF range types unified into one.
• Pokemon — /api/pokemon/search and /api/pokemon/id/{pokemon_id} (v1 /pokemon/scan left on gin, deprecated).
• Tier 3 reads — gym/station query, gym search, gym/pokestop/tappable by-id, pokestop-positions.
• Tier 4 operational — quest-status, clear-quests, devices/all, fort-tracker/{cell,forts}, reload-geojson (GET+POST), skip-preserve-pokemon (GET+POST).

Response structs converted to pointer-based (so Huma documents them; golden-snapshot tests pin the wire format): ApiGymResult, ApiPokestopResult, ApiStationResult, ApiTappableResult. ApiFortScan and ApiPokemonSearch now use ApiLatLon (fixing the same geo.Location lat/lon bug).

Still on gin (intentional): /raw, /health, /version, v1 /pokemon/scan, /pokemon/available.

Notable behavior changes (consistent across the migration)

• Validation errors are now 422 + application/problem+json (was ad-hoc 400/500 {"error":...}).
• Malformed geofence on pokestop-positions/quest-status → 400 (was 500); short-circuits before any DB call.
• gym/query / station/query accept only {"ids":[...]} (legacy bare-array form dropped).
• clear-quests DB-delete behavior verified identical; all per-endpoint success status codes (200/202) preserved.

Test Plan

Automated (CI): golden-snapshot wire-compat for each converted struct, humatest e2e (auth/status/envelope) per group, OpenAPI registration + draft-badge assertions. go test ./..., go build -tags go_json ./..., go vet ./... all green.

Manual (live DB):

• Boot against a populated MariaDB; open /docs and confirm operations group by tag and the 4 fort scan ops show the orange Draft badge.
• Smoke a representative endpoint per group (fort scan, a by-id get, a query, a geofence endpoint).
• Confirm clear-quests still deletes within the geofence as before.

Design + plan: docs/superpowers/specs/2026-05-30-huma-remaining-apis-design.md, docs/superpowers/plans/2026-05-30-huma-remaining-apis.md

🤖 Generated with Claude Code