fix(api): four leftovers from the 49-check live-verification sweep

[MarkusNeusinger]

Summary

• og cards now send Access-Control-Allow-Origin: * to foreign origins — the global CORSMiddleware answers only the site's own allowlist, so chat UIs fetching a card in-page were blocked (the same in-page-fetch failure class the GCS bucket CORS fix removed). setdefault keeps CORSMiddleware's own header for allowlisted origins.
• llms-full.txt lines list implementations as {language}/{library} so the GCS render URL template is instantiable from the file alone; the bare library id forced a second /specs/{id} call per image.
• Error responses on prerendered pages echo the public path — crawlers hitting a dead spec URL were shown the internal /seo-proxy/{slug} routing prefix in the JSON body.
• MCP serverInfo reports the app version via FastMCP(version=APP_VERSION) — it showed fastmcp's package version 3.4.5 while /health said 3.1.0.

Plan

Follow-ups found by the post-deploy live-verification sweep (49 checks across crawler UAs, machine files, REST, images/CORS, JSON-LD, MCP; zero failures on everything already deployed). This commit was originally pushed to the #10489 branch but raced its squash-merge — recovered per the repo's merge-race procedure by cherry-picking onto fresh main; the recreated stale branch was deleted.

Test plan

• ruff check + ruff format --check clean; mypy api core clean; 1,750 unit + 67 integration tests pass (new tests: og ACAO for a foreign Origin, public path in 404 bodies, llms-full {language}/{library} format, MCP version == APP_VERSION)
• After merge + deploy: curl -sI -H "Origin: https://chat.openai.com" https://api.anyplot.ai/og/home.png | grep -i access-control-allow-origin → *; curl https://anyplot.ai/llms-full.txt | head shows {language}/{library} entries; MCP initialize serverInfo.version == 3.1.0

[Copilot]

Pull request overview

This PR applies four small API fixes discovered during a post-deploy live-verification sweep, improving cross-origin OG image consumption, the standalone usability of llms-full.txt, the correctness of error-path reporting for prerendered routes, and MCP server version reporting.

Changes:

• Add Access-Control-Allow-Origin handling for /og/* responses to support cross-origin in-page fetches.
• Update llms-full.txt to list implementations as {language}/{library} so render URLs can be derived without extra API calls.
• Ensure JSON error bodies reflect the public (non-/seo-proxy) path, and set MCP serverInfo.version to the app version.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
api/main.py	Adds OG CORS header logic in the cache-header middleware.
api/routers/seo.py	Changes llms-full.txt format to {language}/{library} and updates header docs accordingly.
api/exceptions.py	Translates /seo-proxy/* internal paths to public paths in JSON error responses.
api/mcp/server.py	Sets FastMCP server version to APP_VERSION for correct MCP serverInfo.
tests/unit/api/test_seo_helpers.py	Updates mocks and asserts for new llms-full.txt format.
tests/unit/api/test_routers.py	Adds/updates tests for llms-full.txt, OG CORS header, and public-path error bodies.
tests/unit/api/mcp/test_tools.py	Adds protocol-level test asserting MCP server version matches APP_VERSION.
CHANGELOG.md	Documents the live-verification follow-up fixes under Unreleased.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

api/exceptions.py:112

• _public_path() treats any path starting with "/seo-proxy" as internal. That will also rewrite unrelated paths like "/seo-proxy-foo" (if they ever exist), which would produce an incorrect public path in error JSON. Since all intended internal routes are either exactly "/seo-proxy" or start with "/seo-proxy/", make the prefix check strict to avoid accidental rewrites.

    path = request.url.path
    if path.startswith("/seo-proxy"):
        return path.removeprefix("/seo-proxy") or "/"
    return path