feat(11-01): wire listTenders through the query builder + add GET /coverage

listTenders now delegates where/orderBy composition to
tender-query.builder.ts (buildTenderWhere/buildOrderBy) instead of the
fixed status/publishedAt clause; pagination bounds unchanged (T-10-15).

New GET /modules/tender-radar/coverage handler returns active-tender
counts grouped by sourcePortal (D-12, UI-05 coverage banner data
source). Declared before @Get(':id') — same static-route-before-:id
convention as source-config (Pitfall 5, Phase-10 regression guard).

Extends tenders.controller.spec.ts: sort whitelist pass-through,
unknown-sort fallback, pagination skip/take, coverage response shape,
and a declaration-order regression test for getCoverage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/tenders/tenders.controller.spec.ts

@@ -19,7 +19,12 @@ import { TendersController } from './tenders.controller';
 
 function makeFakePrisma() {
   const tenders = new Map<string, any>();
-  tenders.set('t1', { id: 't1', title: 'Beispielausschreibung', status: 'active' });
+  tenders.set('t1', {
+    id: 't1',
+    title: 'Beispielausschreibung',
+    status: 'active',
+    sourcePortal: 'doe-opendata',
+  });
   const configs = new Map<string, any>();
   configs.set('doe-opendata', {
     id: 'cfg1',
@@ -34,6 +39,9 @@ function makeFakePrisma() {
       findMany: vi.fn(async (_args?: any) => Array.from(tenders.values())),
       count: vi.fn(async (_args?: any) => tenders.size),
       findUnique: vi.fn(async ({ where }: any) => tenders.get(where.id) ?? null),
+      groupBy: vi.fn(async (_args?: any) => [
+        { sourcePortal: 'doe-opendata', _count: tenders.size },
+      ]),
     },
     tenderSourcePollConfig: {
       findUnique: vi.fn(async ({ where }: any) => configs.get(where.sourceType) ?? null),
@@ -123,4 +131,81 @@ describe('TendersController — route declaration order (static route before :id
     expect(idIdx).toBeGreaterThanOrEqual(0);
     expect(sourceConfigIdx).toBeLessThan(idIdx);
   });
+
+  it('declares getCoverage before getTender so GET /:id cannot shadow it (Pitfall 5)', () => {
+    const methods = Object.getOwnPropertyNames(TendersController.prototype);
+    const coverageIdx = methods.indexOf('getCoverage');
+    const idIdx = methods.indexOf('getTender');
+
+    expect(coverageIdx).toBeGreaterThanOrEqual(0);
+    expect(idIdx).toBeGreaterThanOrEqual(0);
+    expect(coverageIdx).toBeLessThan(idIdx);
+  });
+});
+
+describe('TendersController — listTenders uses the query builder (sort whitelist + pagination bounds)', () => {
+  it('passes buildTenderWhere/buildOrderBy output through to prisma.tender.findMany', async () => {
+    const prisma = makeFakePrisma();
+    const scheduler = { setInterval: vi.fn(), stopJob: vi.fn() } as any;
+    const controller = new TendersController(prisma as any, scheduler);
+
+    await controller.listTenders({ sort: 'deadline', q: 'Bau' } as any);
+
+    const callArgs = prisma.tender.findMany.mock.calls[0][0];
+    expect(callArgs.orderBy).toEqual({ deadlineAt: 'asc' });
+    expect(callArgs.where.AND).toEqual(
+      expect.arrayContaining([
+        {
+          OR: [
+            { title: { contains: 'Bau', mode: 'insensitive' } },
+            { buyerName: { contains: 'Bau', mode: 'insensitive' } },
+          ],
+        },
+      ]),
+    );
+  });
+
+  it('an unknown sort key falls back to the publishedAt-desc default via buildOrderBy', async () => {
+    const prisma = makeFakePrisma();
+    const scheduler = { setInterval: vi.fn(), stopJob: vi.fn() } as any;
+    const controller = new TendersController(prisma as any, scheduler);
+
+    await controller.listTenders({ sort: 'not-whitelisted' } as any);
+
+    const callArgs = prisma.tender.findMany.mock.calls[0][0];
+    expect(callArgs.orderBy).toEqual({ publishedAt: 'desc' });
+  });
+
+  it('respects page/limit for skip/take (pagination bounds unchanged, T-10-15)', async () => {
+    const prisma = makeFakePrisma();
+    const scheduler = { setInterval: vi.fn(), stopJob: vi.fn() } as any;
+    const controller = new TendersController(prisma as any, scheduler);
+
+    await controller.listTenders({ page: 3, limit: 10 } as any);
+
+    const callArgs = prisma.tender.findMany.mock.calls[0][0];
+    expect(callArgs.skip).toBe(20);
+    expect(callArgs.take).toBe(10);
+  });
+});
+
+describe('TendersController — GET /coverage', () => {
+  it('returns distinct sourcePortal distribution and total for active tenders', async () => {
+    const prisma = makeFakePrisma();
+    const scheduler = { setInterval: vi.fn(), stopJob: vi.fn() } as any;
+    const controller = new TendersController(prisma as any, scheduler);
+
+    const result = await controller.getCoverage();
+
+    expect(prisma.tender.groupBy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        by: ['sourcePortal'],
+        where: { status: 'active' },
+      }),
+    );
+    expect(result).toEqual({
+      total: 1,
+      sources: [{ sourcePortal: 'doe-opendata', count: 1 }],
+    });
+  });
 });