fix: align endpoint data formats with production Swagger

[krowvin]

Several endpoint wrappers send JSON v2 to operations that accept unversioned JSON, while BLOB creation and CLOB writes send unversioned JSON where Swagger requires v2. For example, the live profile-list GET returns HTTP 406 with the existing v2 header and HTTP 200 with the corrected header.

• Correct 28 methods across outlets, project locks, profiles, location/level writes, BLOB/CLOB writes, pump accounting, and user-role POST/DELETE.
• Clarify that api_version selects a data representation, not a CDA release. Preserve the existing unversioned JSON aliases and supported v2/XML methods.
• Audit 146 operations against the production Swagger spec, release 2026.05.12-i, and add 34 wire-header regression checks.

Validation: the new checks produce 28 failures on unchanged main; all 132 mock/doctest tests pass after the fix. Strict mypy, Black, isort, and diff checks pass. Live validation was read-only; authenticated write behavior is covered by prepared-request tests, not production writes.

curl -H 'Accept: application/json' 'https://cwms-data.usace.army.mil/cwms-data/timeseries/profile?office-mask=SPK&location-mask=TEST'

The existing project retrieval fix is preserved and now has a header regression test. The additional header tests support the coverage work in #257; this PR does not complete the broader integration-test coverage request.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud