refactor(api) [Patch 2/9]: extract system routes to src/api/system_routes.py

[shadowinlife]

Summary

• Extract 5 system routes from agent/api_server.py into agent/src/api/system_routes.py
• system_routes.py is self-contained — defines HealthResponse locally, resolves _security and _require_shutdown_authorization from host api_server via sys.modules fallback
• Re-export _terminate_current_process back to api_server to preserve existing test monkeypatch compatibility

Why

Part of the API modularisation roadmap (#331). Follows the self-contained route-module pattern established by #375. Each route module is independently extractable, has no shared scaffolding, and gives an immediate measurable reduction in the monolithic api_server.py.

Refs #331
Refs #375

Changes

• New file agent/src/api/system_routes.py: 5 routes (health, correlation, shutdown, skills, api-info) + _terminate_current_process helper
• api_server.py: remove the 5 route definitions, add registration call + re-export
• No shared infrastructure imports (no deps.py, models.py, helpers.py)
• Security(_security) DI pattern preserved exactly for /system/shutdown
• Net reduction verified: api_server.py shrinks from 3,552 to 3,471 lines

Test Plan

• Existing tests pass
• New tests added (not applicable — structural refactor, behaviour unchanged)
• Tested manually (not applicable)

PYTHONPATH=agent pytest agent/tests/test_security_auth_api.py agent/tests/test_spa_deep_link.py -q
# 65 passed
python -m compileall -q agent/api_server.py agent/src/api/system_routes.py
git diff --check

Checklist

• No changes to protected areas (src/agent/, src/session/, src/providers/) without prior discussion
• No hardcoded values (API keys, file paths, magic numbers)
• Code follows CONTRIBUTING.md guidelines
• Documentation updated (not applicable — internal refactor)

---

Overall Project Plan

This PR is Patch 2 of 9 in the API modularisation series (issue #331). The goal is to decompose the 3,552-line api_server.py into 9 self-contained route modules under src/api/, leaving only app factory, Pydantic models, auth dependencies, and shared helpers (~1,200 lines).

Patch	Module	Routes	Lines	Status
1/9	uploads_routes.py	2	~103	✅ Merged — #375
2/9	system_routes.py	5	~81	🔵 This PR — #378
3/9	channels_routes.py	4	~22	📝 Draft — #379 (depends on #378)
4/9	settings_routes.py	4	~230	Pending
5/9	runs_routes.py	4	~300	Pending
6/9	scheduled_routes.py	3	~160	Pending
7/9	swarm_routes.py	7	~240	Pending
8/9	sessions_routes.py	14	~400	Pending
9/9	live_routes.py + cleanup	7+0	~630	Pending

Each patch follows the #375 pattern: self-contained route module, sys.modules fallback for auth, route-level constants/models, re-exports for test monkeypatch compat, zero behaviour change, zero test modifications.

[warren618]

Thanks @shadowinlife, merged this via normal merge so the original commit authorship and co-author credits are preserved.

Local verification before merge:

• PYTHONPATH=agent python -m pytest agent/tests/test_security_auth_api.py agent/tests/test_spa_deep_link.py -q -> 65 passed
• python -m compileall -q agent/api_server.py agent/src/api/system_routes.py
• git diff --check origin/main...HEAD
• Route table sanity confirmed /health, /api, /skills, /correlation, and /system/shutdown are each registered exactly once.

Nice clean extraction for patch 2/9.