feat(app): add POST /step endpoint — executes one attack turn, returns StepResult

server/app.py

@@ -1,7 +1,7 @@
 from contextlib import asynccontextmanager
 from fastapi import FastAPI, HTTPException
 from fastapi.middleware.cors import CORSMiddleware
-from models import ResetResponse
+from models import AttackAction, StepResult, ResetResponse
 from server.environment import RedTeamEnvironment
 from server.config import get_settings
 
@@ -46,3 +46,13 @@ async def reset_episode():
         return ResetResponse(observation=observation, episode_id=observation.episode_id)
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
+
+@app.post("/step", response_model=StepResult)
+async def step_episode(action: AttackAction):
+    try:
+        result = await env.step(action)
+        return result
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))