feat(fc2a): add /api/tags endpoints (autocomplete, create, image association)

Thin async blueprint delegating to TagService. Returns 400 with the
TagValidationError message on bad kind/fandom combos so the frontend can
surface the reason. List/add/remove endpoints scoped under
/api/images/<id>/tags follow REST conventions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_api_tags.py

@@ -0,0 +1,58 @@
+import pytest
+
+from backend.app import create_app
+
+
+@pytest.fixture
+async def app():
+    return create_app()
+
+
+@pytest.fixture
+async def client(app):
+    async with app.test_client() as c:
+        yield c
+
+
+@pytest.mark.asyncio
+async def test_autocomplete_empty(client):
+    resp = await client.get("/api/tags/autocomplete?q=")
+    assert resp.status_code == 200
+    assert await resp.get_json() == []
+
+
+@pytest.mark.asyncio
+async def test_create_tag(client):
+    resp = await client.post("/api/tags", json={"name": "Bob", "kind": "artist"})
+    assert resp.status_code == 201
+    body = await resp.get_json()
+    assert body["name"] == "Bob"
+    assert body["kind"] == "artist"
+
+
+@pytest.mark.asyncio
+async def test_create_tag_rejects_invalid_kind(client):
+    resp = await client.post("/api/tags", json={"name": "Bob", "kind": "notakind"})
+    assert resp.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_create_character_without_fandom_ok(client):
+    resp = await client.post("/api/tags", json={"name": "Alice", "kind": "character"})
+    assert resp.status_code == 201
+
+
+@pytest.mark.asyncio
+async def test_create_character_with_bad_fandom_id(client):
+    artist_resp = await client.post("/api/tags", json={"name": "X", "kind": "artist"})
+    artist_id = (await artist_resp.get_json())["id"]
+    resp = await client.post(
+        "/api/tags", json={"name": "Y", "kind": "character", "fandom_id": artist_id}
+    )
+    assert resp.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_create_tag_missing_required(client):
+    resp = await client.post("/api/tags", json={"name": "Bob"})
+    assert resp.status_code == 400