fix(BA-6922): pluralize the app config allow-list REST v2 prefix

[jopemachine]

Related: #12929 (BA-6922)

Summary

Two REST v2 convention gaps in the app config family, found while reviewing the fragment search surface.

1. app-config-allow-list was the only singular entity prefix. Every other v2 entity collection is plural:

	prefix
before	/v2/app-config-allow-list
after	/v2/app-config-allow-lists
siblings	app-config-definitions, app-config-fragments, resource-policies, model-cards, runtime-variants, …

Renamed across the route registry, the SDK _PATH, its tests, and openapi.json. The CLI command name stays singular (bai admin app-config-allow-list) — every v2 admin group is singular there (resource-policy, model-card, app-config-definition), so the CLI was already right.

2. The missing scoped search on allow-list and definition is now stated, not implied. api/rest/v2/AGENTS.md says a search always comes in two variants — a superadmin /search and a scoped one — and both registries only have the first. That is correct here: both are admin-only entities (every route is superadmin_required) and a non-admin reads them through the app config resolve path rather than querying them. The registry docstrings now say so, so the omission does not read as an oversight to the next person checking the convention.

Breaking change

/v2/app-config-allow-list/* → /v2/app-config-allow-lists/*. The bundled SDK is updated in the same commit, so bai and the Python client keep working; any caller hitting the raw path needs the new one.

Not in this PR

POST /v2/app-config-fragments/scoped-search does not match either documented form — the current /{entity}/{scope_type}/{scope_id}/search or the forward /{entity}/scoped/search (cf. scheduling-history's /kernels/scoped/search). That route is added by #13020 and does not exist on main, so it cannot be fixed from a main-based branch; it is corrected on that PR instead.

Test plan

• Formatter, linter, visibility and mypy clean over the touched manager, client and test packages
• openapi.json regenerated with ./backend.ai mgr api dump-openapi; the delta is exactly the three allow-list paths
• Verified no other reference to the singular path remains (errors/app_config.py keeps probs/app-config-allow-list-not-found, which is an error-type URN, not a route)
• CI verification

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Pluralizes the REST v2 app-config allow-list collection prefix and updates consumers and documentation accordingly.

Changes:

• Renames the route to /v2/app-config-allow-lists.
• Updates the SDK, tests, OpenAPI specification, and changelog.
• Documents why scoped search is omitted for admin-only entities.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/unit/client_v2/test_app_config_allow_list.py	Updates SDK path assertions.
src/ai/backend/manager/api/rest/v2/app_config_definition/registry.py	Documents scoped-search omission.
src/ai/backend/manager/api/rest/v2/app_config_allow_list/registry.py	Renames the route prefix and adds rationale.
src/ai/backend/client/v2/domains_v2/app_config_allow_list.py	Updates the SDK endpoint prefix.
docs/manager/rest-reference/openapi.json	Regenerates affected OpenAPI paths.
changes/13034.breaking.md	Records the breaking route rename.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.