feat(fc2b): add /api/allowlist and /api/aliases endpoints

Allowlist: list-all, get-one (404 if not listed), PATCH threshold
(range-validated), DELETE. Aliases: list-all (with canonical name),
create (idempotent, 201), DELETE by (string, category). Tests
integration-marked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_api_aliases.py

@@ -0,0 +1,51 @@
+import pytest
+
+from backend.app import create_app
+from backend.app.models import TagKind
+from backend.app.services.tag_service import TagService
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture
+async def app():
+    return create_app()
+
+
+@pytest.fixture
+async def client(app):
+    async with app.test_client() as c:
+        yield c
+
+
+@pytest.mark.asyncio
+async def test_create_list_delete(client, db):
+    tag = await TagService(db).find_or_create("Canon", TagKind.character)
+    await db.commit()
+
+    resp = await client.post(
+        "/api/aliases",
+        json={
+            "alias_string": "model_name",
+            "alias_category": "character",
+            "canonical_tag_id": tag.id,
+        },
+    )
+    assert resp.status_code == 201
+
+    resp = await client.get("/api/aliases")
+    body = await resp.get_json()
+    assert any(
+        a["alias_string"] == "model_name"
+        and a["canonical_tag_name"] == "Canon"
+        for a in body
+    )
+
+    resp = await client.delete("/api/aliases/model_name/character")
+    assert resp.status_code == 204
+
+
+@pytest.mark.asyncio
+async def test_create_requires_fields(client):
+    resp = await client.post("/api/aliases", json={"alias_string": "x"})
+    assert resp.status_code == 400

tests/test_api_allowlist.py

@@ -0,0 +1,53 @@
+import pytest
+
+from backend.app import create_app
+from backend.app.models import TagAllowlist, TagKind
+from backend.app.services.tag_service import TagService
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.fixture
+async def app():
+    return create_app()
+
+
+@pytest.fixture
+async def client(app):
+    async with app.test_client() as c:
+        yield c
+
+
+@pytest.mark.asyncio
+async def test_list_and_patch_and_delete(client, db):
+    tag = await TagService(db).find_or_create("AL", TagKind.character)
+    db.add(TagAllowlist(tag_id=tag.id, min_confidence=0.95))
+    await db.commit()
+
+    resp = await client.get("/api/allowlist")
+    assert resp.status_code == 200
+    assert any(r["tag_id"] == tag.id for r in await resp.get_json())
+
+    resp = await client.patch(
+        f"/api/tags/{tag.id}/allowlist", json={"min_confidence": 0.80}
+    )
+    assert resp.status_code == 204
+
+    resp = await client.get(f"/api/tags/{tag.id}/allowlist")
+    assert (await resp.get_json())["min_confidence"] == pytest.approx(0.80)
+
+    resp = await client.delete(f"/api/tags/{tag.id}/allowlist")
+    assert resp.status_code == 204
+    resp = await client.get(f"/api/tags/{tag.id}/allowlist")
+    assert resp.status_code == 404
+
+
+@pytest.mark.asyncio
+async def test_patch_rejects_out_of_range(client, db):
+    tag = await TagService(db).find_or_create("AL2", TagKind.character)
+    db.add(TagAllowlist(tag_id=tag.id))
+    await db.commit()
+    resp = await client.patch(
+        f"/api/tags/{tag.id}/allowlist", json={"min_confidence": 1.5}
+    )
+    assert resp.status_code == 400