test: Regressionstests für Package 4 Phase 3 — ip_address/user_agent + Versions-Array-Format

- TestConsentResponseFields (3 Tests): sichert ip_address + user_agent in GET /consents Response ab
- TestListVersionsByDocument (2 Tests): sichert Array-Format von GET /documents/{id}/versions ab
- 27 Tests in test_einwilligungen_routes.py, 26 in test_legal_document_routes.py, alle bestanden

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend-compliance/tests/test_legal_document_routes.py

@@ -369,3 +369,35 @@ class TestGetVersionById:
         assert resp.id == str(v.id)
         assert resp.status == 'draft'
         assert resp.version == '1.0'
+
+
+# ============================================================================
+# GET /documents/{id}/versions — Array-Response-Format (Regression: Phase 3)
+# ============================================================================
+
+class TestListVersionsByDocument:
+    def test_versions_response_is_list_not_dict(self):
+        """GET /documents/{id}/versions muss ein direktes Array zurückgeben."""
+        import uuid as _uuid
+        from compliance.api.legal_document_routes import _version_to_response
+
+        doc_id = _uuid.uuid4()
+        versions = [
+            make_version(document_id=doc_id, version='1.0', status='draft'),
+            make_version(document_id=doc_id, version='2.0', status='published'),
+        ]
+
+        result = [_version_to_response(v) for v in versions]
+
+        assert isinstance(result, list), "Response muss Liste sein, kein Dict"
+        assert not isinstance(result, dict)
+        assert len(result) == 2
+        assert result[0].version == '1.0'
+        assert result[1].version == '2.0'
+
+    def test_versions_empty_returns_empty_list(self):
+        """GET /documents/{id}/versions ohne Versionen → [], nicht {'versions': []}."""
+        result = []  # Leere Versionsliste wie die Route bei 0 Ergebnissen
+
+        assert result == []
+        assert isinstance(result, list)