fix(ts): strip dotted API-version prefixes (#52)

[abienkowski]

Description

The TypeScript proxy denied almost every non-GET request from a stock Docker CLI. stripAPIVersion (ts/src/proxy.ts) only stripped undotted prefixes (/^\/v\d+\//). The CLI sends dotted ones on every request (/v1.43/containers/create), so the router saw the prefixed path, matched nothing, and fell to the default deny. Go and Rust were not affected.

Fix: a one-line regex change, /^\/v\d+\// → /^\/v\d+(\.\d+)?\//, which accepts /v<major> and /v<major>.<minor>. Go and Rust production code is unchanged.

Closes #52

Repro against built ts/dist

The router was built with config/, and the create request used the body {Image: "chainsafe/lodestar:latest"}.

                                       before   after
DELETE /v1.43/containers/foo           Deny     Allow
POST   /v1.43/containers/beacon/start  Deny     Allow
POST   /v1.43/containers/create        Deny     CreateContainer
POST   /v1/containers/beacon/start     Allow    Allow   (undotted control)

Tests (written first; the RED commit is 6f5706a)

• Same table in all three languages, with each row commented #52: Go TestRouteVersionedPaths, Rust test_route_versioned_paths, and TS routes dotted API-version paths like the unversioned ones.
  • Five rows: dotted delete, start and create; the undotted control; and DELETE /v1.43/containers/json → Deny, which checks that the reserved segment is still caught after the prefix is stripped.
  • Go and Rust passed before the fix. TS failed on the dotted rows.
• TS-only rows that catch over-stripping: DELETE /volumes/containers/foo and DELETE /v1.2.3/containers/foo, both → Deny.
  • With a too-broad regex (/^\/v[^/]*\//) in place, both rows fail.
  • These rows are deliberately not shared. Go and Rust strip any /v…/ first segment, so they allow both paths today. That gap is recorded on Deferred minor findings from the #43/#47/#50/#51 review cycles #55, with Go router output, as a follow-up for a Go router doesn't exclude reserved path segments in extractContainerName (cross-language parity) #24/Rust extract_container_name treats empty segment as a container name (DELETE /containers/ is forwarded) #48-style fix in all three languages.
• deploy/test.sh (32 → 35 checks):
  • POST /v1.45/containers/create with an allowed image (the docker run path) must get 201 or 404 from the daemon, not a proxy 403. Before the fix, TS returned 403.
  • POST /v1.45/containers/no-such-container/start must reach the daemon. A daemon 404 means the request got through; a proxy deny would be 403. Before the fix, TS returned 403.
  • DELETE /v1.45/containers/json → 403. This check passed before the fix too, because default deny already caught it, so it only guards behaviour after the fix.

The RED commit fails in TypeScript on purpose, so this PR has to be squash-merged.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Implementation(s) changed

• Go (tests only)
• Rust (tests only)
• TypeScript
• Quint specification (no change: spec/router.qnt models paths after the version prefix is stripped)
• CI / infrastructure (deploy/test.sh checks)

Testing

• Unit tests pass (make test-all): Go 102, Rust 140, TS 157 (156 pass, 1 skipped)
• Integration tests pass: make test-integration, make test-integration-rs and make test-integration-ts each pass all 35 checks. With the regex reverted, the TS suite fails exactly the two discriminating versioned checks (33 passed, 2 failed).
• Quint verification (make verify): not run locally, since the spec didn't change. It runs in CI (quint job), and make test-spec passes.
• New tests added for the change

Checklist

• I have read CONTRIBUTING.md
• My code follows the project's coding style
• I have updated documentation as needed (test counts in AGENTS.md and README.md)