fix: technical debts left by the Sites, Authors and SEO slices, plus backend support for the new Sites and Authors pagination

features/authors_backend.feature

@@ -865,8 +865,64 @@ Feature: Authors backend, public bylines that articles credit in order
       When it is read back from the repository
       Then the authors come back as 7, 5, 6
 
+  Rule: Total in X-Total-Count
+
+    Background:
+      Given GET /v1/author/ keeps its {"items","total","page","size"} body and also sends total in the X-Total-Count header on every 200
+      And the header equals the body total
+      And X-Total-Count is already in the CORS ExposedHeaders
+      And a refused request sends no X-Total-Count
+
+    Scenario: The total is also sent as a header
+      Given 30 authors
+      When a verified account sends GET /v1/author/?size=5
+      Then the body total is 30 and the header X-Total-Count is "30"
+
+    Scenario: The header follows the search
+      Given 30 authors of which 7 match "mar"
+      When a verified account sends GET /v1/author/?q=mar
+      Then X-Total-Count is "7" and the body total is 7
+
+    Scenario: A page past the end keeps the total in the header
+      Given 30 authors
+      When a verified account sends GET /v1/author/?page=3&size=100
+      Then items is [], the body total is 30 and X-Total-Count is "30"
+
+    Scenario: No match
+      When a verified account sends GET /v1/author/?q=nobody
+      Then items is [], the body total is 0 and X-Total-Count is "0"
+
+    Scenario Outline: Every reader gets the header
+      When GET /v1/author/ is sent with <credentials>
+      Then the status is 200 and X-Total-Count equals the body total
+
+      Examples:
+        | credentials                          |
+        | the owner's jwt cookie               |
+        | a verified admin's jwt cookie        |
+        | a verified account with another role |
+        | a valid API key                      |
+
+    Scenario Outline: Refused requests send no header
+      When GET /v1/author/?<params> is sent with <credentials>
+      Then the status is <status> and no X-Total-Count is sent
+
+      Examples:
+        | params   | credentials                        | status |
+        | size=30  | a verified account                 | 400    |
+        | page=0   | a verified account                 | 400    |
+        | page=abc | a verified account                 | 400    |
+        |          | an unverified account's jwt cookie | 403    |
+        |          | no credentials                     | 401    |
+
+    Scenario: CORS exposes the header
+      Given CORS_ALLOWED_ORIGINS includes "https://app.example.com"
+      When a preflighted GET /v1/author/ comes from that origin
+      Then Access-Control-Expose-Headers lists X-Total-Count
+
   Rule: Documentation
 
     Scenario: The docs describe the new surface
-      Then docs/api.md documents the /v1/author routes with auth and roles, the error tokens, the author shape, article author_ids and authors, the author field of /v1/auth/me and the authors_updated media field
+      Then docs/api.md names X-Total-Count on the GET /v1/author/ row
+      And docs/api.md documents the /v1/author routes with auth and roles, the error tokens, the author shape, article author_ids and authors, the author field of /v1/auth/me and the authors_updated media field
       And docs/architecture.md mentions the author aggregate, its repository and its use cases