feat(fc2b): add /api/allowlist and /api/aliases endpoints

Allowlist: list-all, get-one (404 if not listed), PATCH threshold
(range-validated), DELETE. Aliases: list-all (with canonical name),
create (idempotent, 201), DELETE by (string, category). Tests
integration-marked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/app/api/aliases.py

@@ -0,0 +1,65 @@
+"""Aliases API: list, create, remove."""
+
+from quart import Blueprint, jsonify, request
+
+from ..extensions import make_engine, make_session_factory
+from ..services.ml.aliases import AliasService
+
+aliases_bp = Blueprint("aliases", __name__, url_prefix="/api")
+
+_engine = None
+_Session = None
+
+
+def _session_factory():
+    global _engine, _Session
+    if _engine is None:
+        _engine = make_engine()
+        _Session = make_session_factory(_engine)
+    return _Session
+
+
+@aliases_bp.route("/aliases", methods=["GET"])
+async def list_aliases():
+    Session = _session_factory()
+    async with Session() as session:
+        rows = await AliasService(session).list_all()
+    return jsonify(
+        [
+            {
+                "alias_string": r.alias_string,
+                "alias_category": r.alias_category,
+                "canonical_tag_id": r.canonical_tag_id,
+                "canonical_tag_name": r.canonical_tag_name,
+            }
+            for r in rows
+        ]
+    )
+
+
+@aliases_bp.route("/aliases", methods=["POST"])
+async def create_alias():
+    body = await request.get_json()
+    required = {"alias_string", "alias_category", "canonical_tag_id"}
+    if not body or not required.issubset(body):
+        return jsonify({"error": f"required: {sorted(required)}"}), 400
+    Session = _session_factory()
+    async with Session() as session:
+        await AliasService(session).create(
+            body["alias_string"],
+            body["alias_category"],
+            body["canonical_tag_id"],
+        )
+        await session.commit()
+    return "", 201
+
+
+@aliases_bp.route(
+    "/aliases/<alias_string>/<alias_category>", methods=["DELETE"]
+)
+async def remove_alias(alias_string: str, alias_category: str):
+    Session = _session_factory()
+    async with Session() as session:
+        await AliasService(session).remove(alias_string, alias_category)
+        await session.commit()
+    return "", 204