feat(api): tags routes

Add lib/api/routes/tags.js: list + upsert at /api/tags, and an
entity-scoped router mounted at /api/:entity_type/:entity_id/tags
for attach (idempotent), list, and detach. entity_type is bounded by
a zod enum covering space/project/task/page/ref/resource/source_doc/
conversation.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

lib/api/routes/tags.js

@@ -0,0 +1,64 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import * as repo from '../../db/repos/tags.js';
+import { validate } from '../validate.js';
+import { requireWrite } from '../cap.js';
+import { asyncWrap } from '../errors.js';
+
+const ENTITY_TYPES = ['space','project','task','page','ref','resource','source_doc','conversation'];
+
+const upsertSchema = z.object({
+  name: z.string().min(1).max(64),
+  description: z.string().nullable().optional(),
+  color: z.string().nullable().optional()
+});
+
+const attachSchema = z.object({ tag_id: z.string().uuid() });
+
+const entityParams = z.object({
+  entity_type: z.enum(ENTITY_TYPES),
+  entity_id: z.string().uuid()
+});
+
+const entityTagParams = entityParams.extend({ tag_id: z.string().uuid() });
+
+export const router = Router();
+export const entityScopedRouter = Router({ mergeParams: true });
+
+router.get('/', asyncWrap(async (_req, res) => { res.json(await repo.list()); }));
+
+router.post('/',
+  requireWrite('tag'),
+  validate({ body: upsertSchema }),
+  asyncWrap(async (req, res) => {
+    const row = await repo.upsert(req.body.name, {
+      description: req.body.description, color: req.body.color
+    });
+    res.status(201).json(row);
+  })
+);
+
+entityScopedRouter.get('/',
+  validate({ params: entityParams }),
+  asyncWrap(async (req, res) => {
+    res.json(await repo.listForEntity(req.params.entity_type, req.params.entity_id));
+  })
+);
+
+entityScopedRouter.post('/',
+  requireWrite('tag'),
+  validate({ params: entityParams, body: attachSchema }),
+  asyncWrap(async (req, res) => {
+    await repo.attach(req.params.entity_type, req.params.entity_id, req.body.tag_id);
+    res.status(204).end();
+  })
+);
+
+entityScopedRouter.delete('/:tag_id',
+  requireWrite('tag'),
+  validate({ params: entityTagParams }),
+  asyncWrap(async (req, res) => {
+    await repo.detach(req.params.entity_type, req.params.entity_id, req.params.tag_id);
+    res.status(204).end();
+  })
+);