feat: new http api v3

[kairoaraujo]

Summary

New http for /api/v3

Changes

• src/djehuty/services/ (git, email, handles, permissions): framework-neutral services the v3 endpoints need — git repository access and smart-HTTP, collaborative-permission checks, transactional e-mail (via config.email_interface), and handle.net PID registration. Git statistics (languages/contributors) reproduce the legacy byte-weighted / GitHub-style payloads and caching.
• src/djehuty/api/v3/: the v3 surface as resource-based routers mirroring v2 (datasets, collections, profile, reviews, statistics, explore, admin, ssi, ro_crates, codemeta, authors, groups, accounts, tags, files, git), each reproducing its legacy handler's side effects AS-IS (db writes, cache invalidations, e-mails, DataCite DOI flow, git/filesystem effects), with OpenAPI examples.
• src/djehuty/application.py, route_groups.py, configs: register and mount the api-v3 group with versioned API docs (/api/docs/v2, /api/docs/v3) driven by a single API_VERSIONS list.
• tests/unit/: v3 group tests (registration, legacy-override, umbrella mount) plus pinned side-effect call shapes; dispatch/v2-group tests adjusted now that /v3 resolves to the new stack.
• docs/http-migration-api-v3-side-effects.md: the v3 side-effect catalog — scaffolding documenting what each route must reproduce, the AS-IS deviations kept on purpose, and the remaining deferral.

Approval Checklist

• I agree to follow Djehuty's code of conduct.
• I have read and I have follow the code contribution workflow.
• Code style and conventions were respected.
• Documentation has been updated where needed (README, docs, or examples).
• Review approved by at least one maintainer.
• Merge readiness (PR is squashed into a single commit and follows the commit template).

Closes #254
Closes #252

Screenshots (optional)

Before/After visuals, UI changes, or relevant logs.

Notes (optional)

Additional context, caveats, or follow-up tasks.

[codecov]

Codecov Report

❌ Patch coverage is 33.77687% with 1294 lines in your changes missing coverage. Please review.
✅ Project coverage is 25.54%. Comparing base (11f4f37) to head (61ff629).

Files with missing lines	Patch %	Lines
src/djehuty/services/git.py	10.47%	187 Missing and 1 partial ⚠️
src/djehuty/api/v3/git.py	24.28%	156 Missing and 3 partials ⚠️
src/djehuty/api/v3/datasets/files.py	16.66%	140 Missing ⚠️
src/djehuty/api/v3/datasets/publishing.py	27.80%	129 Missing and 6 partials ⚠️
src/djehuty/api/v3/profile.py	26.19%	93 Missing ⚠️
src/djehuty/api/v3/collections/publishing.py	21.05%	60 Missing ⚠️
src/djehuty/api/v3/admin.py	25.00%	54 Missing ⚠️
src/djehuty/api/v3/ssi.py	20.68%	46 Missing ⚠️
src/djehuty/api/v3/datasets/authors.py	30.76%	36 Missing ⚠️
src/djehuty/api/v3/statistics.py	29.16%	34 Missing ⚠️
... and 23 more

Additional details and impacted files

@@                   Coverage Diff                    @@
##           feat/new-http-api-v2     #248      +/-   ##
========================================================
+ Coverage                 23.96%   25.54%   +1.57%     
========================================================
  Files                        67      103      +36     
  Lines                     12412    14366    +1954     
  Branches                   2307     2574     +267     
========================================================
+ Hits                       2975     3670     +695     
- Misses                     9140    10368    +1228     
- Partials                    297      328      +31     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kairoaraujo]

• git_info_refs path traversal: genuinely fixed: it built a filesystem path from git_uuid before validation. Added an is_valid_uuid guard (and one in create_repository). Valid ids are unaffected; only malformed input is now rejected (404), matching legacy's "unknown repo" outcome.
• Other path findings (profile, files, admin): false positives: the ids are server-generated or already is_valid_uuid-validated / DB-resolved before any file access.
• ReDoS (convenience.py): verbatim from the legacy search tokenizer, non-nested regex, reproduced as-is.
• SSI redirect/cookie + docs XSS: faithful ports of existing legacy behavior.
• Also removed an unused import in the new test.