Add read-only production runtime audit

apps/web/app/api/sections/route.ts

@@ -0,0 +1,34 @@
+import { NextResponse } from "next/server";
+
+export const runtime = "nodejs";
+
+const API_GATEWAY_URL =
+  process.env.API_GATEWAY_URL ?? process.env.AI_SERVICE_URL ?? "http://localhost:8000";
+
+function ragBaseUrl() {
+  return API_GATEWAY_URL.replace(/\/v1\/rag(?:\/query)?\/?$/, "");
+}
+
+export async function GET(request: Request) {
+  const drugId = new URL(request.url).searchParams.get("drug_id")?.trim() ?? "";
+  if (!/^[a-z0-9_]{1,160}$/i.test(drugId)) {
+    return NextResponse.json({ error: "invalid_drug_id" }, { status: 400 });
+  }
+
+  try {
+    const upstream = await fetch(
+      `${ragBaseUrl()}/v1/rag/sections?drug_id=${encodeURIComponent(drugId)}`,
+      {
+        headers: { "X-Client-Version": "1.0.0" },
+        cache: "no-store",
+        signal: AbortSignal.timeout(8_000),
+      }
+    );
+    if (!upstream.ok) {
+      return NextResponse.json({ error: "sections_unavailable" }, { status: upstream.status });
+    }
+    return NextResponse.json(await upstream.json());
+  } catch {
+    return NextResponse.json({ error: "sections_unavailable" }, { status: 502 });
+  }
+}