7957 scotus api metadata

[nikollycardoso]

Fixes

Part of #7957. Stacked on #8121; the next PR adds the entries and documents endpoints and closes the issue.

Summary

This PR adds /api/rest/v4/scotus-docket-metadata/, a read-only, v4-only endpoint for ScotusDocketMetadata. Like the RECAP endpoints it requires an account, and questions_presented_file comes back as a URL, as in the issue's example.

It also adds the first two shared bases BaseSourceFilter and BaseSourceReadOnlyViewSet, which the next PR reuses.

Documentation

Once merged, the following documentation needs to be updated:

• Add the endpoint to the REST API docs on the wiki.

Deployment

This PR should:

• skip-deploy (skips everything below)
  • skip-web-deploy
  • skip-celery-deploy
  • skip-cronjob-deploy
  • skip-daemon-deploy

AI Disclosure

• No AI tools were used to create the content of this PR.
• Parts of this PR were created with the help of an AI tool, and I have carefully reviewed all of its content and take full responsibility for it.

[claude]

I reviewed this PR and didn't find any bugs. Because it adds a new authenticated, permission-gated REST API surface (new viewset, filterset, and serializer for SCOTUS docket metadata), a human look would still be worthwhile.

What was reviewed: the new ScotusDocketMetadataViewSet/BaseSourceReadOnlyViewSet routing (v4-only, confirmed absent from v3), the write-path rejection (403 for non-permitted users, 405 for superusers on the read-only viewset), the filterset's handling of known/unknown params, and the serializer's URL fields. Also checked a possible N+1 from the hyperlinked docket field on list/retrieve — the new test_queries_are_flat test specifically asserts query count doesn't grow as result rows grow, which rules this out. Also checked that any authenticated user (not just ones with model-level view permission) can read all SCOTUS metadata via DjangoModelPermissions — this matches the PR's stated intent and the existing RECAP endpoint pattern of gating on login only, not a flaw introduced here.

Extended reasoning...

The diff adds a new read-only, v4-only DRF endpoint (/api/rest/v4/scotus-docket-metadata/) with its own serializer, filterset, viewset base classes, URL registration, and ~250 lines of new tests; it touches authentication/permission enforcement (DjangoModelPermissions) and data exposure (which authenticated users can read SCOTUS metadata), both security-relevant surfaces, though no injection or write-path risk was found. Test coverage is thorough (v3 absence, 401/403/405 behavior, serialization shape, filter correctness, unknown-param rejection, and a query-count regression test). The bug hunt reported no confirmed bugs, but because the change touches permission-gated API surface and the broader read-access scope question, deferring for a human look is the safer call rather than approving outright.