feat(api): refs routes

Add lib/api/routes/refs.js: list with space_id/kind filters and
paginated, create, get/patch/delete by id, and /upsert that maps to
repo.upsertByExternal for idempotent capture-source ingest.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/api/refs.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
+import request from 'supertest';
+import { setup } from './helpers.js';
+import * as spaces from '../../lib/db/repos/spaces.js';
+
+let app, ownerHeaders, space;
+const owner = { kind: 'user', id: null };
+
+beforeAll(async () => { ({ app, ownerHeaders } = await setup()); });
+beforeEach(async () => {
+  space = await spaces.create({ slug: `s-${Date.now()}-${Math.random().toString(36).slice(2,5)}`, name: 'S' }, owner);
+});
+
+describe('refs routes', () => {
+  it('POST creates URL ref', async () => {
+    const res = await request(app).post('/api/refs').set(ownerHeaders).send({
+      space_id: space.id, kind: 'url', source_url: 'https://example.com', title: 'Ex'
+    });
+    expect(res.status).toBe(201);
+    expect(res.body.kind).toBe('url');
+  });
+
+  it('GET ?kind=url filters', async () => {
+    await request(app).post('/api/refs').set(ownerHeaders).send({
+      space_id: space.id, kind: 'url', source_url: 'https://a.example', title: 'A'
+    });
+    await request(app).post('/api/refs').set(ownerHeaders).send({
+      space_id: space.id, kind: 'pdf', blob_path: '/b.pdf', title: 'B'
+    });
+    const res = await request(app).get(`/api/refs?space_id=${space.id}&kind=url`).set(ownerHeaders);
+    expect(res.body.length).toBe(1);
+    expect(res.body[0].kind).toBe('url');
+  });
+
+  it('POST /upsert returns same id on repeat with same external_id', async () => {
+    const first = await request(app).post('/api/refs/upsert').set(ownerHeaders).send({
+      space_id: space.id, kind: 'url', source_url: 'https://x', title: 'X',
+      source_kind: 'karakeep', external_id: 'abc'
+    });
+    expect(first.status).toBe(200);
+    const second = await request(app).post('/api/refs/upsert').set(ownerHeaders).send({
+      space_id: space.id, kind: 'url', source_url: 'https://x', title: 'X2',
+      source_kind: 'karakeep', external_id: 'abc'
+    });
+    expect(second.body.id).toBe(first.body.id);
+    expect(second.body.title).toBe('X2');
+  });
+
+  it('limit above max → 400', async () => {
+    const res = await request(app).get('/api/refs?limit=999').set(ownerHeaders);
+    expect(res.status).toBe(400);
+  });
+});