feat(api): Implement API Resource Standard compliance

- Create BaseResource with formatDate() and formatDecimal() utilities
- Create 11 API Resource classes for all models
- Update all 6 controllers to return wrapped responses via wrapResource()
- Update frontend API client with unwrapResponse() helper
- Update all 63+ backend tests to expect 'data' wrapper
- Regenerate Scribe API documentation

BREAKING CHANGE: All API responses now wrap data in 'data' key per architecture spec.

Backend Tests: 70 passed, 5 failed (unrelated to data wrapper)
Frontend Unit: 10 passed
E2E Tests: 102 passed, 20 skipped
API Docs: Generated successfully

Refs: openspec/changes/api-resource-standard

backend/tests/Feature/Auth/AuthenticationTest.php

@@ -2,10 +2,10 @@
 
 namespace Tests\Feature\Auth;
 
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Tests\TestCase;
 use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
+use Tests\TestCase;
 
 class AuthenticationTest extends TestCase
 {
@@ -52,11 +52,11 @@ class AuthenticationTest extends TestCase
         $payload = base64_encode($payload);
         $payload = str_replace(['+', '/', '='], ['-', '_', ''], $payload);
 
-        $signature = hash_hmac('sha256', $header . '.' . $payload, config('app.key'), true);
+        $signature = hash_hmac('sha256', $header.'.'.$payload, config('app.key'), true);
         $signature = base64_encode($signature);
         $signature = str_replace(['+', '/', '='], ['-', '_', ''], $signature);
 
-        return $header . '.' . $payload . '.' . $signature;
+        return $header.'.'.$payload.'.'.$signature;
     }
 
     protected function decodeJWT(string $token): ?object
@@ -67,9 +67,9 @@ class AuthenticationTest extends TestCase
             return null;
         }
 
-        list($header, $payload, $signature) = $parts;
+        [$header, $payload, $signature] = $parts;
 
-        $expectedSignature = hash_hmac('sha256', $header . '.' . $payload, config('app.key'), true);
+        $expectedSignature = hash_hmac('sha256', $header.'.'.$payload, config('app.key'), true);
         $expectedSignature = base64_encode($expectedSignature);
         $expectedSignature = str_replace(['+', '/', '='], ['-', '_', ''], $expectedSignature);
 
@@ -103,16 +103,19 @@ class AuthenticationTest extends TestCase
             'refresh_token',
             'token_type',
             'expires_in',
-            'user' => [
+            'data' => [
                 'id',
                 'name',
                 'email',
                 'role',
+                'active',
+                'created_at',
+                'updated_at',
             ],
         ]);
-        $response->assertJsonPath('user.name', $user->name);
-        $response->assertJsonPath('user.email', $user->email);
-        $response->assertJsonPath('user.role', 'manager');
+        $response->assertJsonPath('data.name', $user->name);
+        $response->assertJsonPath('data.email', $user->email);
+        $response->assertJsonPath('data.role', 'manager');
     }
 
     /** @test */
@@ -196,8 +199,10 @@ class AuthenticationTest extends TestCase
 
         $response->assertStatus(200);
         $response->assertJson([
-            'id' => $user->id,
-            'email' => $user->email,
+            'data' => [
+                'id' => $user->id,
+                'email' => $user->email,
+            ],
         ]);
     }
 

backend/tests/Feature/Capacity/CapacityTest.php

@@ -9,6 +9,7 @@ use App\Models\User;
 use App\Services\CapacityService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\TestCase;
+
 use function Pest\Laravel\assertDatabaseHas;
 
 /**
@@ -22,11 +23,23 @@ test('4.1.11 GET /api/capacity calculates individual capacity', function () {
     $teamMember = TeamMember::factory()->create(['role_id' => $role->id]);
 
     $response = $this->getJson("/api/capacity?month=2026-02&team_member_id={$teamMember->id}", [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(200);
-    $expected = app(CapacityService::class)->calculateIndividualCapacity($teamMember->id, '2026-02');
+    $service = app(CapacityService::class);
+    $capacity = $service->calculateIndividualCapacity($teamMember->id, '2026-02');
+    $expected = [
+        'data' => [
+            'team_member_id' => $teamMember->id,
+            'month' => '2026-02',
+            'working_days' => $service->calculateWorkingDays('2026-02'),
+            'person_days' => $capacity['person_days'],
+            'hours' => $capacity['hours'],
+            'details' => $capacity['details'],
+        ],
+    ];
+
     $response->assertExactJson($expected);
 });
 
@@ -39,11 +52,11 @@ test('4.1.12 Capacity accounts for availability', function () {
     TeamMemberAvailability::factory()->forDate('2026-02-04')->availability(0.0)->create(['team_member_id' => $member->id]);
 
     $response = $this->getJson("/api/capacity?month=2026-02&team_member_id={$member->id}", [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(200);
-    $details = collect($response->json('details'));
+    $details = collect($response->json('data.details'));
 
     expect($details->firstWhere('date', '2026-02-03')['availability'])->toBe(0.5);
     expect($details->firstWhere('date', '2026-02-04')['availability'])->toBe(0);
@@ -63,11 +76,11 @@ test('4.1.13 Capacity subtracts PTO', function () {
     ]);
 
     $response = $this->getJson("/api/capacity?month=2026-02&team_member_id={$member->id}", [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(200);
-    $details = collect($response->json('details'));
+    $details = collect($response->json('data.details'));
 
     expect($details->where('is_pto', true)->count())->toBe(3);
     expect($details->firstWhere('date', '2026-02-11')['availability'])->toBe(0);
@@ -85,7 +98,7 @@ test('4.1.14 Capacity subtracts holidays', function () {
     ]);
 
     $response = $this->getJson("/api/capacity?month=2026-02&team_member_id={$member->id}", [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(200);
@@ -111,13 +124,13 @@ test('4.1.15 GET /api/capacity/team sums active members', function () {
     }
 
     $response = $this->getJson('/api/capacity/team?month=2026-02', [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(200);
-    $response->assertJsonCount(2, 'members');
-    expect(round($response->json('person_days'), 2))->toBe(round($expectedDays, 2));
-    expect($response->json('hours'))->toBe($expectedHours);
+    $response->assertJsonCount(2, 'data.members');
+    expect(round($response->json('data.person_days'), 2))->toBe(round($expectedDays, 2));
+    expect($response->json('data.hours'))->toBe($expectedHours);
 });
 
 test('4.1.16 GET /api/capacity/revenue calculates possible revenue', function () {
@@ -129,11 +142,11 @@ test('4.1.16 GET /api/capacity/revenue calculates possible revenue', function ()
     $expectedRevenue = app(CapacityService::class)->calculatePossibleRevenue('2026-02');
 
     $response = $this->getJson('/api/capacity/revenue?month=2026-02', [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(200);
-    $response->assertJson(['possible_revenue' => $expectedRevenue]);
+    $response->assertJsonPath('data.possible_revenue', $expectedRevenue);
 });
 
 test('4.1.17 POST /api/holidays creates holiday', function () {
@@ -144,7 +157,7 @@ test('4.1.17 POST /api/holidays creates holiday', function () {
         'name' => 'Test Holiday',
         'description' => 'Test description',
     ], [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(201);
@@ -162,7 +175,7 @@ test('4.1.18 POST /api/ptos creates PTO request', function () {
         'end_date' => '2026-02-11',
         'reason' => 'Refresh',
     ], [
-        'Authorization' => "Bearer {$token}"
+        'Authorization' => "Bearer {$token}",
     ]);
 
     $response->assertStatus(201);

backend/tests/Feature/Project/ProjectTest.php

@@ -73,12 +73,11 @@ class ProjectTest extends TestCase
 
         $response = $this->withToken($token)
             ->postJson('/api/projects', $payload);
+        dump($response->json());
 
-        $response->assertStatus(201)
-            ->assertJsonFragment([
-                'code' => $payload['code'],
-                'title' => $payload['title'],
-            ]);
+        $response->assertStatus(201);
+        $response->assertJsonPath('data.code', $payload['code']);
+        $response->assertJsonPath('data.title', $payload['title']);
 
         $this->assertDatabaseHas('projects', [
             'code' => $payload['code'],
@@ -110,7 +109,7 @@ class ProjectTest extends TestCase
         $payload = $this->projectPayload();
         $projectId = $this->withToken($token)
             ->postJson('/api/projects', $payload)
-            ->json('id');
+            ->json('data.id');
 
         $invalidStatus = $this->statusId('In Progress');
 
@@ -123,7 +122,7 @@ class ProjectTest extends TestCase
 
         $this->transitionProjectStatus($projectId, 'SOW Approval', $token)
             ->assertStatus(200)
-            ->assertJsonPath('status.name', 'SOW Approval');
+            ->assertJsonPath('data.status.name', 'SOW Approval');
     }
 
     // 3.1.16 API test: Estimate approved requires estimate value
@@ -132,7 +131,7 @@ class ProjectTest extends TestCase
         $token = $this->loginAsManager();
         $projectId = $this->withToken($token)
             ->postJson('/api/projects', $this->projectPayload())
-            ->json('id');
+            ->json('data.id');
 
         $this->transitionProjectStatus($projectId, 'SOW Approval', $token)
             ->assertStatus(200);
@@ -154,7 +153,7 @@ class ProjectTest extends TestCase
         $payload = $this->projectPayload(['approved_estimate' => 120]);
         $projectId = $this->withToken($token)
             ->postJson('/api/projects', $payload)
-            ->json('id');
+            ->json('data.id');
 
         $workflow = [
             'Pre-sales',
@@ -172,7 +171,7 @@ class ProjectTest extends TestCase
         foreach (array_slice($workflow, 1) as $statusName) {
             $this->transitionProjectStatus($projectId, $statusName, $token)
                 ->assertStatus(200)
-                ->assertJsonPath('status.name', $statusName);
+                ->assertJsonPath('data.status.name', $statusName);
         }
     }
 
@@ -182,11 +181,11 @@ class ProjectTest extends TestCase
         $token = $this->loginAsManager();
         $projectId = $this->withToken($token)
             ->postJson('/api/projects', $this->projectPayload())
-            ->json('id');
+            ->json('data.id');
 
         $this->transitionProjectStatus($projectId, 'SOW Approval', $token)
             ->assertStatus(200)
-            ->assertJsonPath('status.name', 'SOW Approval');
+            ->assertJsonPath('data.status.name', 'SOW Approval');
 
         $this->assertDatabaseHas('projects', [
             'id' => $projectId,
@@ -200,12 +199,12 @@ class ProjectTest extends TestCase
         $token = $this->loginAsManager();
         $projectId = $this->withToken($token)
             ->postJson('/api/projects', $this->projectPayload())
-            ->json('id');
+            ->json('data.id');
 
         $this->withToken($token)
             ->putJson("/api/projects/{$projectId}/estimate", ['approved_estimate' => 275])
             ->assertStatus(200)
-            ->assertJsonPath('approved_estimate', '275.00');
+            ->assertJsonPath('data.approved_estimate', '275.00');
 
         $this->assertSame('275.00', (string) Project::find($projectId)->approved_estimate);
     }
@@ -216,14 +215,14 @@ class ProjectTest extends TestCase
         $token = $this->loginAsManager();
         $projectId = $this->withToken($token)
             ->postJson('/api/projects', $this->projectPayload(['approved_estimate' => 100]))
-            ->json('id');
+            ->json('data.id');
 
         $forecast = ['2025-01' => 33, '2025-02' => 33, '2025-03' => 34];
 
         $this->withToken($token)
             ->putJson("/api/projects/{$projectId}/forecast", ['forecasted_effort' => $forecast])
             ->assertStatus(200)
-            ->assertJsonFragment(['forecasted_effort' => $forecast]);
+            ->assertJsonPath('data.forecasted_effort', $forecast);
 
         $this->assertSame($forecast, Project::find($projectId)->forecasted_effort);
     }
@@ -234,7 +233,7 @@ class ProjectTest extends TestCase
         $token = $this->loginAsManager();
         $projectId = $this->withToken($token)
             ->postJson('/api/projects', $this->projectPayload(['approved_estimate' => 100]))
-            ->json('id');
+            ->json('data.id');
 
         $forecast = ['2025-01' => 50, '2025-02' => 50, '2025-03' => 50];
 

backend/tests/Feature/TeamMember/TeamMemberTest.php

@@ -2,13 +2,13 @@
 
 namespace Tests\Feature\TeamMember;
 
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Tests\TestCase;
-use App\Models\User;
-use App\Models\TeamMember;
-use App\Models\Role;
 use App\Models\Allocation;
 use App\Models\Project;
+use App\Models\Role;
+use App\Models\TeamMember;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
 
 class TeamMemberTest extends TestCase
 {
@@ -52,11 +52,13 @@ class TeamMemberTest extends TestCase
 
         $response->assertStatus(201);
         $response->assertJson([
-            'name' => 'John Doe',
-            'role_id' => $role->id,
-            'hourly_rate' => '150.00',
-            'active' => true,
+            'data' => [
+                'name' => 'John Doe',
+                'hourly_rate' => '150.00',
+                'active' => true,
+            ],
         ]);
+        $response->assertJsonPath('data.role.id', $role->id);
 
         $this->assertDatabaseHas('team_members', [
             'name' => 'John Doe',
@@ -123,7 +125,7 @@ class TeamMemberTest extends TestCase
             ->getJson('/api/team-members');
 
         $response->assertStatus(200);
-        $response->assertJsonCount(3);
+        $response->assertJsonCount(3, 'data');
     }
 
     // 2.1.13 API test: Filter by active status
@@ -141,14 +143,14 @@ class TeamMemberTest extends TestCase
             ->getJson('/api/team-members?active=true');
 
         $response->assertStatus(200);
-        $response->assertJsonCount(2);
+        $response->assertJsonCount(2, 'data');
 
         // Get only inactive
         $response = $this->withHeader('Authorization', "Bearer {$token}")
             ->getJson('/api/team-members?active=false');
 
         $response->assertStatus(200);
-        $response->assertJsonCount(1);
+        $response->assertJsonCount(1, 'data');
     }
 
     // 2.1.14 API test: PUT /api/team-members/{id} updates member
@@ -168,8 +170,10 @@ class TeamMemberTest extends TestCase
 
         $response->assertStatus(200);
         $response->assertJson([
-            'id' => $teamMember->id,
-            'hourly_rate' => '175.00',
+            'data' => [
+                'id' => $teamMember->id,
+                'hourly_rate' => '175.00',
+            ],
         ]);
 
         $this->assertDatabaseHas('team_members', [
@@ -195,8 +199,10 @@ class TeamMemberTest extends TestCase
 
         $response->assertStatus(200);
         $response->assertJson([
-            'id' => $teamMember->id,
-            'active' => false,
+            'data' => [
+                'id' => $teamMember->id,
+                'active' => false,
+            ],
         ]);
 
         $this->assertDatabaseHas('team_members', [

backend/tests/Unit/Resources/HolidayResourceTest.php

@@ -0,0 +1,32 @@
+<?php
+
+use App\Http\Resources\HolidayResource;
+use App\Models\Holiday;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+test('holiday resource wraps data', function () {
+    $holiday = Holiday::create([
+        'date' => '2026-02-14',
+        'name' => 'Test Holiday',
+        'description' => 'Description',
+    ]);
+
+    $response = (new HolidayResource($holiday))->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data']['name'])->toBe('Test Holiday');
+});
+
+test('holiday resource collection uses data wrapper', function () {
+    Holiday::create(['date' => '2026-02-14', 'name' => 'Day One', 'description' => null]);
+    Holiday::create(['date' => '2026-03-01', 'name' => 'Day Two', 'description' => null]);
+
+    $response = HolidayResource::collection(Holiday::limit(2)->get())->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data'])->toHaveCount(2);
+});

backend/tests/Unit/Resources/ProjectResourceTest.php

@@ -0,0 +1,31 @@
+<?php
+
+use App\Http\Resources\ProjectResource;
+use App\Models\Project;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+test('project resource includes expected fields inside data wrapper', function () {
+    $project = Project::factory()->approved()->create();
+    $project->load(['status', 'type']);
+
+    $response = (new ProjectResource($project))->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload)->toHaveKey('data');
+    expect($payload['data'])->toHaveKey('status');
+    expect($payload['data'])->toHaveKey('type');
+    expect($payload['data'])->toHaveKey('approved_estimate');
+});
+
+test('project resource collection wraps multiple entries', function () {
+    $projects = Project::factory()->count(2)->create();
+
+    $response = ProjectResource::collection($projects)->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data'])->toHaveCount(2);
+});

backend/tests/Unit/Resources/PtoResourceTest.php

@@ -0,0 +1,56 @@
+<?php
+
+use App\Http\Resources\PtoResource;
+use App\Models\Pto;
+use App\Models\Role;
+use App\Models\TeamMember;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+test('pto resource returns wrapped data with team member', function () {
+    $role = Role::factory()->create();
+    $teamMember = TeamMember::factory()->create(['role_id' => $role->id]);
+
+    $pto = Pto::create([
+        'team_member_id' => $teamMember->id,
+        'start_date' => '2026-02-10',
+        'end_date' => '2026-02-12',
+        'reason' => 'Travel',
+        'status' => 'pending',
+    ]);
+    $pto->load('teamMember');
+
+    $response = (new PtoResource($pto))->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data']['team_member_id'])->toBe($teamMember->id);
+    expect($payload['data']['team_member']['id'])->toBe($teamMember->id);
+});
+
+test('pto resource collection keeps data wrapper', function () {
+    $role = Role::factory()->create();
+    $member = TeamMember::factory()->create(['role_id' => $role->id]);
+
+    Pto::create([
+        'team_member_id' => $member->id,
+        'start_date' => '2026-02-10',
+        'end_date' => '2026-02-10',
+        'reason' => 'Travel',
+        'status' => 'approved',
+    ]);
+    Pto::create([
+        'team_member_id' => $member->id,
+        'start_date' => '2026-03-10',
+        'end_date' => '2026-03-12',
+        'reason' => 'Rest',
+        'status' => 'approved',
+    ]);
+
+    $response = PtoResource::collection(Pto::limit(2)->get())->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data'])->toHaveCount(2);
+});

backend/tests/Unit/Resources/RoleResourceTest.php

@@ -0,0 +1,28 @@
+<?php
+
+use App\Http\Resources\RoleResource;
+use App\Models\Role;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+test('role resource returns wrapped data', function () {
+    $role = Role::factory()->create();
+
+    $response = (new RoleResource($role))->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload)->toHaveKey('data');
+    expect($payload['data']['id'])->toBe($role->id);
+});
+
+test('role resource collection keeps data wrapper', function () {
+    $roles = Role::factory()->count(2)->create();
+
+    $response = RoleResource::collection($roles)->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data'])->toHaveCount(2);
+});

backend/tests/Unit/Resources/TeamMemberResourceTest.php

@@ -0,0 +1,32 @@
+<?php
+
+use App\Http\Resources\TeamMemberResource;
+use App\Models\Role;
+use App\Models\TeamMember;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+test('team member resource wraps data and includes role when loaded', function () {
+    $role = Role::factory()->create();
+    $teamMember = TeamMember::factory()->create(['role_id' => $role->id]);
+    $teamMember->load('role');
+
+    $response = (new TeamMemberResource($teamMember))->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data']['id'])->toBe($teamMember->id);
+    expect($payload['data']['role']['id'])->toBe($role->id);
+});
+
+test('team member resource collection keeps data wrapper', function () {
+    $role = Role::factory()->create();
+    $teamMembers = TeamMember::factory()->count(2)->create(['role_id' => $role->id]);
+
+    $response = TeamMemberResource::collection($teamMembers)->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data'])->toHaveCount(2);
+});

backend/tests/Unit/Resources/UserResourceTest.php

@@ -0,0 +1,30 @@
+<?php
+
+use App\Http\Resources\UserResource;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+test('user resource wraps response with data', function () {
+    $user = User::factory()->create();
+
+    $response = (new UserResource($user))->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect(array_key_exists('data', $payload))->toBeTrue();
+    expect($payload['data']['id'])->toBe($user->id);
+    expect($payload['data'])->toHaveKey('email');
+});
+
+test('user resource collection honors data wrapper', function () {
+    $users = User::factory()->count(2)->create();
+
+    $response = UserResource::collection($users)->toResponse(Request::create('/'));
+    $payload = $response->getData(true);
+
+    expect($payload['data'])->toHaveCount(2);
+    expect($payload['data'][0])->toHaveKey('id');
+});