fix(api): mount Autumn at /api/autumn so OpenAPI docs are not hijacked

Elysia mount(autumnHandler) as a single function registered ALL /* and
returned Autumn 404 for / and /spec.json. Mount under /api/autumn with
path rewrite to match Autumn router and React provider defaults.

Author: izadoesdev

.agents/skills/databuddy/references/codebase-map.md

@@ -22,6 +22,7 @@ Use this file when the task spans multiple packages or when the right edit locat
 
 - Elysia API service
 - Default dev port: `3001`
+- **Autumn (`autumn-js/fetch`)**: Do not `mount(autumnHandler(...))` with a single argument — Elysia treats that as a catch‑all `/*` and Autumn returns `{"code":"not_found",...}` for every non‑Autumn path (breaks OpenAPI docs at `/` and `/spec.json`). Mount at `/api/autumn` and pass requests through `withAutumnApiPath` so routed paths stay under `/api/autumn` (see [`apps/api/src/lib/autumn-mount.ts`](/Users/iza/Dev/Databuddy/apps/api/src/lib/autumn-mount.ts)).
 - AI insights: [`apps/api/src/routes/insights.ts`](/Users/iza/Dev/Databuddy/apps/api/src/routes/insights.ts) — Top Pages rows include a **Human label** (opaque path segments → “Demo page”, etc.); system prompt asks for risk/watch insights in good weeks and data-grounded suggestions. Dashboard [`insight-card`](/Users/iza/Dev/Databuddy/apps/dashboard/app/(main)/insights/_components/insight-card.tsx): **Ask agent** + path-aware **View events** (`/events/stream?path=…` when a path is parsed from copy). Dedupes on cooldown-window DB keys `(websiteId|type|direction)`; failed insert returns no new insights. Funnel/MRR/retention insights require those metrics in query data—do not invent in prompts alone.
 - Handles routes such as public endpoints, webhooks, health, query, MCP, and agent-related APIs
 - Typical work:

apps/api/src/index.ts

@@ -18,6 +18,7 @@ import { Elysia } from "elysia";
 import { initLogger, log, parseError } from "evlog";
 import { evlog, useLogger } from "evlog/elysia";
 import { applyAuthWideEvent } from "@/lib/auth-wide-event";
+import { AUTUMN_API_PREFIX, withAutumnApiPath } from "@/lib/autumn-mount";
 import {
 	apiLoggerDrain,
 	enrichApiWideEvent,
@@ -278,7 +279,7 @@ const app = new Elysia({ precompile: true })
 			})
 	)
 	.use(webhooks)
-	.mount(
+	.mount(AUTUMN_API_PREFIX, (request) =>
 		autumnHandler({
 			identify: async (request) => {
 				try {
@@ -313,7 +314,7 @@ const app = new Elysia({ precompile: true })
 					return null;
 				}
 			},
-		})
+		})(withAutumnApiPath(request))
 	)
 	.use(query)
 	.use(agent)

apps/api/src/lib/autumn-mount.ts

@@ -0,0 +1,10 @@
+/** Elysia `.mount("/api/autumn", …)` strips the prefix, so the inner pathname is `/attach` not `/api/autumn/attach`. Autumn's router matches full paths under `/api/autumn`. */
+const AUTUMN_API_PREFIX = "/api/autumn";
+
+export function withAutumnApiPath(request: Request): Request {
+	const url = new URL(request.url);
+	const path = `${AUTUMN_API_PREFIX}${url.pathname === "/" ? "" : url.pathname}`;
+	return new Request(new URL(path + url.search, url.origin), request);
+}
+
+export { AUTUMN_API_PREFIX };