feat: GET /transcripts/{filename} — serve transcript content

tests/test_api.py

@@ -45,6 +45,30 @@ def test_status_requires_auth():
     assert r.status_code == 401
 
 
+def make_app_for_dir(output_dir: str):
+    from fastapi import FastAPI
+    from api.router import router, current_user
+    app = FastAPI()
+    app.dependency_overrides[current_user] = lambda: {"username": "", "output_dir": output_dir, "is_admin": False}
+    app.include_router(router)
+    return app
+
+
+def test_get_transcript_returns_content(tmp_path):
+    f = tmp_path / "2026-01-01-0900-test.md"
+    f.write_text("# Hello\n\ncontent here\n")
+    client = TestClient(make_app_for_dir(str(tmp_path)))
+    r = client.get("/transcripts/2026-01-01-0900-test.md")
+    assert r.status_code == 200
+    assert "Hello" in r.text
+
+
+def test_get_transcript_rejects_path_traversal(tmp_path):
+    client = TestClient(make_app_for_dir(str(tmp_path)))
+    r = client.get("/transcripts/..%2Fsecret.md")
+    assert r.status_code == 404
+
+
 def test_login_rejects_wrong_credentials():
     import tempfile, os
     from unittest.mock import patch