feat(issues): S3 REST routes — systems CRUD + project open-issues

Third slice of Issues + Systems (spec #825).

routes/systems.py (nested /api/projects/<id>/...): GET/POST systems (list adds
per-system open_issue_count via one grouped query), GET/PATCH/DELETE a system
(GET returns records split into issues/tasks/notes), GET .../systems/<id>/records
(kind/open_only filters), GET .../issues (project's open issues for the project
view + dashboard roll-up). login_required; project access via get_project_for_user;
writes gated by can_write_project (clean 403); system.project_id verified to match
the path. Blueprint registered in app.py.

services/systems.py: + open_issue_counts_by_system (one grouped query) and
list_issues (project issues, open by default).

Tests: structural (blueprint registered + in app, handlers callable, service
contracts take user_id) — matches the house route-test pattern.

Refs plan 825 (S3).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/scribe/services/systems.py

@@ -207,3 +207,43 @@ async def count_open_issues(user_id: int, project_id: int) -> int:
             )
         )
         return int(result.scalar() or 0)
+
+
+async def open_issue_counts_by_system(user_id: int, project_id: int) -> dict[int, int]:
+    """{system_id: open-issue count} for all systems in a project, in one query.
+    {} if no read access."""
+    if not await access.can_read_project(user_id, project_id):
+        return {}
+    async with async_session() as session:
+        rows = await session.execute(
+            select(RecordSystem.system_id, func.count(Note.id))
+            .join(Note, Note.id == RecordSystem.note_id)
+            .join(System, System.id == RecordSystem.system_id)
+            .where(
+                System.project_id == project_id,
+                Note.task_kind == "issue",
+                Note.status.isnot(None),
+                Note.status.not_in(["done", "cancelled"]),
+                Note.deleted_at.is_(None),
+            )
+            .group_by(RecordSystem.system_id)
+        )
+        return {sid: cnt for sid, cnt in rows.fetchall()}
+
+
+async def list_issues(user_id: int, project_id: int, open_only: bool = True) -> list[Note]:
+    """Issues in a project (open by default), newest first. [] if no read access."""
+    if not await access.can_read_project(user_id, project_id):
+        return []
+    async with async_session() as session:
+        query = select(Note).where(
+            Note.project_id == project_id,
+            Note.task_kind == "issue",
+            Note.status.isnot(None),
+            Note.deleted_at.is_(None),
+        )
+        if open_only:
+            query = query.where(Note.status.not_in(["done", "cancelled"]))
+        query = query.order_by(Note.updated_at.desc())
+        result = await session.execute(query)
+        return list(result.scalars().all())