/**
 * GET /api/admin/icloud/probe[?dry=1] (icloud.read) → ProbeResult: unconfigured | configured | ok | error, never record
 * contents (ADMIN.md §8 package 11). `dry=1` only checks that a key is stored and parses. Each run is audited as
 * icloud.probe with the outcome; rate-limited because every non-dry run is a signed call to Apple.
 */
export const GET = adminRoute("icloud.read", async (request, ctx) => {
  const dryRun = new URL(request.url).searchParams.get("dry") === "1";
  const result = await probe({ dryRun });
  await recordAdminAudit(ctx, {
    action: "icloud.probe", targetType: "system", targetId: "icloud",
    after: { status: result.status, dryRun, httpStatus: result.httpStatus, serverErrorCode: result.serverErrorCode },
    outcome: result.status === "error" ? "failed" : "ok",
  });
  return adminJson(result);
}, { rateLimit: "icloud-probe" });