Merged in feature/eula.part1 (pull request #206)

eula support

* eula support

* docs

docs/ai.generated/queryapi.summary.md

@@ -39,6 +39,14 @@ This document provides a comprehensive summary of all REST API endpoints availab
 | /admin/users/{email}                   | GET, HEAD, PATCH, DELETE | AdminService         |
 | /admin/users/{email}/disable           | POST                     | AdminService         |
 | /admin/users/{email}/enable            | POST                     | AdminService         |
+| /eula                                  | GET                      | EulaService          |
+| /eula/status                           | GET                      | EulaService          |
+| /eula/agree                            | POST                     | EulaService          |
+| /admin/eula                            | GET, POST                | EulaService          |
+| /admin/eula/{version_id}               | GET, PATCH               | EulaService          |
+| /admin/eula/{version_id}/activate      | POST                     | EulaService          |
+| /admin/eula/agreements                 | GET                      | EulaService          |
+| /admin/eula/compliance                 | GET                      | EulaService          |
 
 ---
 
@@ -299,6 +307,56 @@ This document provides a comprehensive summary of all REST API endpoints availab
   - **Idempotent**: Safe to call multiple times
   - Returns: `{success, email, action, cognito_subject_id, timestamp}` (200 OK)
 
+## EULA Service
+
+### Public Endpoints
+
+- **GET /eula** - Get current EULA version (public, no authentication required)
+  - Returns: `{id, version, title, content, effective_date}` (200 OK)
+  - Returns 404 if no current EULA is configured
+
+- **GET /eula/status** - Check user's agreement status
+  - Requires authentication
+  - Returns: `{has_agreed, current_version, current_version_id, agreed_at?, agreed_version?}`
+
+- **POST /eula/agree** - Record user agreement to current EULA
+  - Requires authentication
+  - IP address automatically captured from request
+  - **Idempotent**: Returns 200 if already agreed, 201 for new agreement
+  - Returns: `{id, eula_version_id, eula_version, agreed_at}`
+
+### Administrative Endpoints
+
+- **GET /admin/eula** - List all EULA versions with pagination
+  - Query Parameters: `page`, `page_size`
+  - Returns: `{versions[], total, has_more}`
+
+- **POST /admin/eula** - Create a new EULA version
+  - Request Body: `{version, title, content, effective_date}`
+  - Content should be in Markdown format
+  - Returns: Created `EulaVersion` object (201 Created)
+
+- **GET /admin/eula/{version_id}** - Get specific EULA version
+  - Returns: Full `EulaVersion` object
+
+- **PATCH /admin/eula/{version_id}** - Update EULA metadata
+  - Request Body: `{title?, effective_date?}`
+  - Note: Content cannot be modified (audit integrity)
+  - Returns: Updated `EulaVersion` object
+
+- **POST /admin/eula/{version_id}/activate** - Activate EULA version
+  - Sets this version as current (atomically clears previous)
+  - Returns: Activated `EulaVersion` with `is_current=true`
+
+- **GET /admin/eula/agreements** - List EULA agreements
+  - Query Parameters: `page`, `page_size`, `version_id?`, `user_id?`
+  - Returns: `{agreements[], total, has_more}`
+
+- **GET /admin/eula/compliance** - Get compliance report
+  - Query Parameters: `page`, `page_size`, `version_id?`, `agreed?`
+  - Defaults to current EULA version
+  - Returns: `{version_id, version, total_users, agreed_count, not_agreed_count, compliance_percentage, users[], page, page_size, has_more}`
+
 ## Common Response Codes
 
 All endpoints may return the following standard HTTP response codes: