Simplify setup flow and public API docs

tests/test_api.py

@@ -35,8 +35,9 @@ def test_custom_api_docs_include_only_current_api_surfaces(tmp_path: Path) -> No
     assert "GET /api/v1/hostnames/<secret>" in docs.text
     assert "POST /api/v1/hostnames/<secret>/rotate-update-url" in docs.text
     assert "Rotate update URL" in docs.text
-    assert "GET /api/v1/admin/dashboard" in docs.text
-    assert "GET /api/v1/admin/events" in docs.text
+    assert "Operator API" not in docs.text
+    assert "/api/v1/admin" not in docs.text
+    assert "admin:<admin-password>" not in docs.text
     assert "https://karldns.de/api/v1/hostnames" in docs.text
     assert "http://localhost:8080/api/v1/hostnames" not in docs.text
     assert "registration_url" in docs.text
@@ -52,10 +53,6 @@ def test_custom_api_docs_include_only_current_api_surfaces(tmp_path: Path) -> No
     assert "fonts.googleapis.com" not in docs.headers["content-security-policy"]
 
     expected_paths = {
-        "/api/v1/admin/dashboard",
-        "/api/v1/admin/events",
-        "/api/v1/admin/hostnames",
-        "/api/v1/admin/records",
         "/api/v1/hostnames",
         "/api/v1/hostnames/{dashboard_secret}",
         "/api/v1/hostnames/{dashboard_secret}/rotate-update-url",
@@ -70,7 +67,12 @@ def test_custom_api_docs_include_only_current_api_surfaces(tmp_path: Path) -> No
     assert "/events" not in schema["paths"]
     assert any(tag["name"] == "hostnames" for tag in schema["tags"])
     assert any(tag["name"] == "router" for tag in schema["tags"])
-    assert any(tag["name"] == "admin" for tag in schema["tags"])
+    assert all(tag["name"] != "admin" for tag in schema["tags"])
+    schema_names = set(schema["components"]["schemas"])
+    assert "AdminDashboardResponse" not in schema_names
+    assert "AdminHostnamesResponse" not in schema_names
+    assert "AdminEventsResponse" not in schema_names
+    assert "AdminRecordsResponse" not in schema_names
 
 
 def test_custom_api_docs_use_visitor_public_ip(tmp_path: Path) -> None:
@@ -110,10 +112,14 @@ def test_openapi_hides_custom_operator_routes(tmp_path: Path) -> None:
         "/ops/records",
         "/records",
         "/events",
+        "/api/v1/admin/dashboard",
+        "/api/v1/admin/events",
+        "/api/v1/admin/hostnames",
+        "/api/v1/admin/records",
     }
     assert client.get("/redoc").status_code == 404
     assert forbidden_paths.isdisjoint(schema["paths"])
-    assert "/api/v1/admin/dashboard" in schema["paths"]
+    assert not any(path.startswith("/api/v1/admin") for path in schema["paths"])
 
 
 def test_openapi_marks_generated_links_as_secret(tmp_path: Path) -> None: