feat(api): expose sync status (#1635)

* feat(api): expose sync status

* fix(api): harden sync status review paths

* fix(api): address sync status review

* fix(api): tighten sync status review fixes

* fix(api): address sync status review

* test(api): avoid secret-like sync fixture key

* test(api): reuse sync status fixture key

* fix(api): align sync route helpers

* fix(api): tighten sync status scoping

* fix(api): make sync status schema nullable-compliant

app/controllers/api/v1/syncs_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+class Api::V1::SyncsController < Api::V1::BaseController
+  include Pagy::Backend
+
+  before_action :ensure_read_scope
+  before_action :set_sync, only: [ :show ]
+
+  def index
+    @per_page = safe_per_page_param
+    @pagy, @syncs = pagy(
+      family_syncs_query.preload(:syncable, :children).ordered,
+      page: safe_page_param,
+      limit: @per_page
+    )
+
+    render :index
+  end
+
+  def latest
+    @sync = family_syncs_query.preload(:syncable, :children).ordered.first
+    return render json: { data: nil } unless @sync
+
+    render :show
+  end
+
+  def show
+    render :show
+  end
+
+  private
+
+    def set_sync
+      raise ActiveRecord::RecordNotFound unless valid_uuid?(params[:id])
+
+      @sync = family_syncs_query.preload(:syncable, :children).find(params[:id])
+    end
+
+    def ensure_read_scope
+      authorize_scope!(:read)
+    end
+
+    def family_syncs_query
+      Sync.for_family(Current.family, resource_owner: Current.user)
+    end
+end