feat(entity): add Entity models, service layer, and database migration [AYG-69]

[amostt]

Summary

• Pure Pydantic entity models (EntityBase, EntityCreate, EntityUpdate, EntityPublic, EntitiesPublic) with field validation
• Service layer with 5 CRUD operations via supabase-py table builder pattern, all enforcing ownership via owner_id
• Supabase SQL migration: entities table with UUID PK, owner index, updated_at trigger, and 4 RLS policies (including WITH CHECK on UPDATE)
• 34 unit tests (14 model + 20 service) covering happy paths, edge cases, and error handling

Changes

New Files

File	Purpose
backend/app/models/entity.py	Entity Pydantic models (Base, Create, Update, Public, collection)
backend/app/services/__init__.py	Service layer package marker
backend/app/services/entity_service.py	Entity CRUD operations via Supabase REST client
backend/tests/unit/test_entity_models.py	14 model validation tests
backend/tests/unit/test_entity_service.py	20 service layer tests (mocked Supabase)
supabase/migrations/20260227000000_create_entities.sql	Database migration with RLS
supabase/config.toml	Minimal Supabase project scaffold

Modified Files

File	Change
backend/app/models/__init__.py	Re-export entity models from package

Acceptance Criteria

• AC-1: EntityCreate validates and serializes (title="Test Entity", description="A test")
• AC-2: EntityPublic includes id, title, description, owner_id, created_at, updated_at
• AC-3: entity_service.create_entity(supabase, data, owner_id) inserts into entities table, returns EntityPublic
• AC-4: SQL migration creates entities table with correct columns, index, trigger, RLS
• AC-5: EntityUpdate with no fields is a no-op (fetches and returns current entity)
• AC-6: EntityCreate with empty title rejected by Pydantic validation
• AC-7: get_entity for non-existent ID raises ServiceError(404, "ENTITY_NOT_FOUND")
• AC-8: list_entities with limit > 100 capped at 100
• AC-9: Supabase insert error caught and re-raised as ServiceError
• AC-10: Infrastructure errors raise ServiceError(500); API errors (not-found) raise ServiceError(404)

Review Summary

• Critical: 0 | High: 0 | Medium: 8 | Low: 7
• All critical/high findings from 3-subagent review were auto-fixed:
  • SEC-001: Removed exception details from error messages (info leak prevention)
  • BUG-001: Added empty-data guard on create_entity insert response
  • BUG-002/SEC-002: Differentiated APIError (404) from infrastructure errors (500) in get_entity
  • SEC-004/FUNC-001: Added WITH CHECK clause to UPDATE RLS policy
  • FUNC-002/SEC-003: Added lower-bound clamping for offset/limit parameters
• Test Coverage: 34 tests, all passing
• Security: No critical issues remaining

Test Plan

• Unit tests passing: uv run pytest tests/unit/test_entity_models.py tests/unit/test_entity_service.py -v (34/34)
• Full test suite: uv run pytest tests/unit/ tests/integration/ -v (166/166)
• Lint: uv run ruff check — clean
• Types: uv run mypy app/services/ app/models/ — clean
• Manual: Verify SQL migration syntax against Supabase CLI

Template False Positive Notes

Old tests in tests/api/routes/, tests/crud/, tests/scripts/ have pre-existing import errors (from app.models import Item, User) due to the SQLModel → Supabase migration in progress. These are not regressions from AYG-69 — they were broken before this PR by AYG-67's models/ package creation. Tracked for cleanup in a future story.

Related to AYG-64

Generated with Claude Code by Aygentic