feat(quests): expose the quest log and step endpoints

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/api/src/quests/quest.controller.ts

@@ -0,0 +1,52 @@
+import { Controller, Get, Param, Post } from '@nestjs/common';
+import { DEMO_CHARACTER_ID } from '../demo/demo-character.constants';
+import { QuestService } from './quest.service';
+import { QuestDto, QuestInteractionResultDto } from './quest.types';
+
+/**
+ * The character's quest log (Playable Slice 0.9 §12).
+ *
+ * The character comes from the session stand-in, never from the request, so a
+ * caller cannot read somebody else's quests.
+ */
+@Controller('quests')
+export class QuestController {
+  constructor(private readonly questService: QuestService) {}
+
+  @Get()
+  getQuestLog(): Promise<QuestDto[]> {
+    return this.questService.getQuestLog(DEMO_CHARACTER_ID);
+  }
+}
+
+/**
+ * The two things a player can do to a quest at an NPC (spec §3, §5, §6, §8).
+ *
+ * Neither route takes a body. Which step is current, what it grants and what it
+ * consumes are all the server's to decide (AGENTS.md §5) -- the request only
+ * names who is being spoken to and about what.
+ *
+ * Deliberately not dialogue actions (decision D4): carrying `START_QUEST` out
+ * through the dialogue tree would need a response-selection endpoint and an
+ * action executor, which is the branching narrative engine §10 rules out.
+ */
+@Controller('npcs/:npcKey/quests/:questKey')
+export class NpcQuestController {
+  constructor(private readonly questService: QuestService) {}
+
+  @Post('accept')
+  acceptQuest(
+    @Param('npcKey') npcKey: string,
+    @Param('questKey') questKey: string,
+  ): Promise<QuestInteractionResultDto> {
+    return this.questService.acceptQuest(DEMO_CHARACTER_ID, npcKey, questKey);
+  }
+
+  @Post('advance')
+  advanceQuest(
+    @Param('npcKey') npcKey: string,
+    @Param('questKey') questKey: string,
+  ): Promise<QuestInteractionResultDto> {
+    return this.questService.advanceQuest(DEMO_CHARACTER_ID, npcKey, questKey);
+  }
+}