feat(api): source-docs routes

Add lib/api/routes/source_docs.js: scoped POST under a resource,
get/patch/delete by id, and POST /:id/resync as a Plan 3 stub gated
by ENABLE_RESYNC (503 by default, 202 once workers ship). upstream_url
is required by the DB so the zod schema enforces it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/api/source_docs.test.js

@@ -0,0 +1,59 @@
+import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
+import request from 'supertest';
+import { setup } from './helpers.js';
+import * as spaces from '../../lib/db/repos/spaces.js';
+import * as resources from '../../lib/db/repos/resources.js';
+
+let app, ownerHeaders, resource;
+const owner = { kind: 'user', id: null };
+
+beforeAll(async () => { ({ app, ownerHeaders } = await setup()); });
+beforeEach(async () => {
+  const space = await spaces.create({ slug: `s-${Date.now()}-${Math.random().toString(36).slice(2,5)}`, name: 'S' }, owner);
+  resource = await resources.create({
+    space_id: space.id, slug: 'svc', name: 'svc', runtime_type: 'lxc'
+  }, owner);
+  delete process.env.ENABLE_RESYNC;
+});
+
+describe('source-docs routes', () => {
+  it('POST scoped to resource creates row', async () => {
+    const res = await request(app)
+      .post(`/api/resources/${resource.id}/source-docs`).set(ownerHeaders)
+      .send({ name: 'README', upstream_url: 'https://docs.example/readme' });
+    expect(res.status).toBe(201);
+    expect(res.body.resource_id).toBe(resource.id);
+  });
+
+  it('GET /:id and PATCH update', async () => {
+    const c = await request(app)
+      .post(`/api/resources/${resource.id}/source-docs`).set(ownerHeaders)
+      .send({ name: 'CONFIG', upstream_url: 'https://docs.example/c' });
+    const get = await request(app).get(`/api/source-docs/${c.body.id}`).set(ownerHeaders);
+    expect(get.body.name).toBe('CONFIG');
+    const patched = await request(app).patch(`/api/source-docs/${c.body.id}`).set(ownerHeaders)
+      .send({ version: '1.2.3' });
+    expect(patched.body.version).toBe('1.2.3');
+  });
+
+  it('POST /:id/resync without env → 503', async () => {
+    const c = await request(app)
+      .post(`/api/resources/${resource.id}/source-docs`).set(ownerHeaders)
+      .send({ name: 'doc', upstream_url: 'https://docs.example/d' });
+    const res = await request(app)
+      .post(`/api/source-docs/${c.body.id}/resync`).set(ownerHeaders);
+    expect(res.status).toBe(503);
+    expect(res.body.error.code).toBe('feature_disabled');
+  });
+
+  it('POST /:id/resync with env=true → 202', async () => {
+    process.env.ENABLE_RESYNC = 'true';
+    const c = await request(app)
+      .post(`/api/resources/${resource.id}/source-docs`).set(ownerHeaders)
+      .send({ name: 'doc', upstream_url: 'https://docs.example/d' });
+    const res = await request(app)
+      .post(`/api/source-docs/${c.body.id}/resync`).set(ownerHeaders);
+    expect(res.status).toBe(202);
+    expect(res.body.queued).toBe(true);
+  });
+});