feat(api): tags routes

Add lib/api/routes/tags.js: list + upsert at /api/tags, and an
entity-scoped router mounted at /api/:entity_type/:entity_id/tags
for attach (idempotent), list, and detach. entity_type is bounded by
a zod enum covering space/project/task/page/ref/resource/source_doc/
conversation.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/api/tags.test.js

@@ -0,0 +1,55 @@
+import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
+import request from 'supertest';
+import { setup } from './helpers.js';
+import * as spacesRepo from '../../lib/db/repos/spaces.js';
+
+let app, ownerHeaders, space;
+const owner = { kind: 'user', id: null };
+
+beforeAll(async () => { ({ app, ownerHeaders } = await setup()); });
+beforeEach(async () => {
+  space = await spacesRepo.create({ slug: `s-${Date.now()}-${Math.random().toString(36).slice(2,5)}`, name: 'S' }, owner);
+});
+
+describe('tags routes', () => {
+  it('POST upserts (idempotent)', async () => {
+    const a = await request(app).post('/api/tags').set(ownerHeaders).send({ name: 'urgent' });
+    const b = await request(app).post('/api/tags').set(ownerHeaders).send({ name: 'urgent', color: '#f00' });
+    expect(a.body.id).toBe(b.body.id);
+    expect(b.body.color).toBe('#f00');
+  });
+
+  it('attach + list-for-entity + detach', async () => {
+    const page = await request(app).post(`/api/spaces/${space.id}/pages`).set(ownerHeaders)
+      .send({ slug: 'pg', title: 'PG' });
+    const tag = await request(app).post('/api/tags').set(ownerHeaders).send({ name: 'wip' });
+    const attach = await request(app)
+      .post(`/api/page/${page.body.id}/tags`).set(ownerHeaders)
+      .send({ tag_id: tag.body.id });
+    expect(attach.status).toBe(204);
+    const list = await request(app).get(`/api/page/${page.body.id}/tags`).set(ownerHeaders);
+    expect(list.body.length).toBe(1);
+    expect(list.body[0].name).toBe('wip');
+    const det = await request(app)
+      .delete(`/api/page/${page.body.id}/tags/${tag.body.id}`).set(ownerHeaders);
+    expect(det.status).toBe(204);
+    const after = await request(app).get(`/api/page/${page.body.id}/tags`).set(ownerHeaders);
+    expect(after.body.length).toBe(0);
+  });
+
+  it('attach is idempotent', async () => {
+    const page = await request(app).post(`/api/spaces/${space.id}/pages`).set(ownerHeaders)
+      .send({ slug: 'pg2', title: 'PG2' });
+    const tag = await request(app).post('/api/tags').set(ownerHeaders).send({ name: 'x' });
+    await request(app).post(`/api/page/${page.body.id}/tags`).set(ownerHeaders).send({ tag_id: tag.body.id });
+    const dup = await request(app).post(`/api/page/${page.body.id}/tags`).set(ownerHeaders)
+      .send({ tag_id: tag.body.id });
+    expect(dup.status).toBe(204);
+  });
+
+  it('unknown entity_type → 400', async () => {
+    const res = await request(app)
+      .get(`/api/widget/00000000-0000-0000-0000-000000000000/tags`).set(ownerHeaders);
+    expect(res.status).toBe(400);
+  });
+});