feat(api): add Entity CRUD REST endpoints with auth and pagination [AYG-70]

[amostt]

Summary

• Add 5 thin CRUD route handlers (POST/GET/GET/{id}/PATCH/{id}/DELETE/{id}) at /api/v1/entities
• All endpoints require Clerk JWT authentication (PrincipalDep) and delegate to entity_service
• Pagination validated at route layer: offset>=0, limit 1-100 via Query constraints
• 22 integration tests covering full CRUD lifecycle, auth enforcement, ownership isolation, validation, and pagination

Changes

• CREATE backend/app/api/routes/entities.py — 5 route handlers
• MODIFY backend/app/api/main.py — register entities router
• CREATE backend/tests/integration/test_entities.py — 22 integration tests

Acceptance Criteria

• AC-1: POST /api/v1/entities creates entity with 201, owner_id from JWT
• AC-2: GET /api/v1/entities returns paginated list (data + count) with offset/limit defaults
• AC-3: GET /api/v1/entities/{id} returns entity for valid owned ID
• AC-4: PATCH /api/v1/entities/{id} updates only provided fields
• AC-5: DELETE /api/v1/entities/{id} returns 204
• AC-6: No auth → 401 on all entity endpoints
• AC-7: Non-owned entity → 404 (not 403)
• AC-8: Invalid POST body → 422 with details array
• AC-9: Pagination limit capped at 100 (422 rejection at route layer)
• AC-10: Non-existent UUID → 404 with ENTITY_NOT_FOUND code

Review Summary

• Critical: 0 | High: 0 (2 high findings auto-fixed) | Medium: 5 | Low: 8
• 3-subagent parallel review (code-quality, test-coverage, security)
• Auto-fixed: pagination Query constraints (FUNC-001/SEC-001), error code assertions (TEST-001)
• All 188 backend tests passing, lint/types clean
• Security: No critical issues. Auth, IDOR prevention, injection protection all verified.

Test Plan

• 22 integration tests passing (uv run pytest backend/tests/integration/test_entities.py -v)
• 188 total backend tests passing (zero regressions)
• Ruff lint clean
• mypy typecheck clean
• Manual: curl -H "Authorization: Bearer <token>" http://localhost:8000/api/v1/entities

Fixes AYG-70
Related to AYG-64

🤖 Generated with Claude Code by Aygentic

[amostt]

Opened against wrong repo — closing.