Flask-restx migration wrap-up + synonym registry

Largest change of the day: a full migration of backend/api/ from Flask Blueprint to flask-restx Namespace+Resource, touching 29 files and removing every remaining Blueprint() call from the backend tree. A voice.py hand-fix was needed because some function-based routes had slipped past the automated pass; those are now Resource classes too, and flask-restx is pinned in pyproject.toml.

Follow-up restore-pass brought endpoint behavior back in line with pre-migration URLs. Namespace double-prefixing is gone so every route resolves at its old URL, the SPA serves root ‘/’, and a fresh Api is built per create_app() so the factory yields independent instances. Auth decorators now return dict instead of a jsonify Response so 401/403 rejections serialize rather than 500, and the voice endpoint’s 503 Retry-After header is back. A mount_namespace test helper replaced the blueprint-based fixtures.

With routes reshaped, mypy --strict was re-cleared over backend/api/: a local flask_restx stub lives under mypy_path = ‘stubs’, and ResponseReturnValue annotations landed on every Resource HTTP method.

Merged TKT-1061: a self-healing param synonym registry for abilities plus result-aware tool follow-ups, so the assistant can recover from near-miss parameter names and chain tools off previous results.

Finally, a small security/lint cleanup: representative /tmp path literals in the follow-up interpolation and web_browse config tests now derive from tempfile.gettempdir(), which also matches the real _DOWNLOAD_DIR root for web_download and quiets SonarCloud S5443.

• Migrated 29 backend/api/ files from Flask Blueprint to flask-restx Namespace+Resource; zero Blueprint() calls remain.

• Restored pre-migration URL routing by removing Namespace double-prefixing; SPA serves root ‘/’.

• Fresh Api built per create_app() so the factory yields independent app instances; mount_namespace helper replaces blueprint-based fixtures.

• Auth decorators return dict (not jsonify Response) so 401/403 serialize instead of 500; voice 503 Retry-After header restored.

• mypy --strict re-clean via local flask_restx stub on mypy_path and ResponseReturnValue annotations on every Resource method.

• Derive test temp paths from tempfile.gettempdir() instead of /tmp literals, clearing SonarCloud S5443.