feat(issues): S3 REST routes — systems CRUD + project open-issues

Third slice of Issues + Systems (spec #825).

routes/systems.py (nested /api/projects/<id>/...): GET/POST systems (list adds
per-system open_issue_count via one grouped query), GET/PATCH/DELETE a system
(GET returns records split into issues/tasks/notes), GET .../systems/<id>/records
(kind/open_only filters), GET .../issues (project's open issues for the project
view + dashboard roll-up). login_required; project access via get_project_for_user;
writes gated by can_write_project (clean 403); system.project_id verified to match
the path. Blueprint registered in app.py.

services/systems.py: + open_issue_counts_by_system (one grouped query) and
list_issues (project issues, open by default).

Tests: structural (blueprint registered + in app, handlers callable, service
contracts take user_id) — matches the house route-test pattern.

Refs plan 825 (S3).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_routes_systems.py

@@ -0,0 +1,38 @@
+"""Structural tests for the systems blueprint — registration + handler/service
+contracts. Full HTTP integration needs a live DB + auth the unit env lacks."""
+import inspect
+
+
+def test_systems_blueprint_registered():
+    from scribe.routes.systems import systems_bp
+    assert systems_bp.name == "systems"
+    assert systems_bp.url_prefix == "/api/projects"
+
+
+def test_systems_blueprint_registered_in_app():
+    from scribe.app import create_app
+    app = create_app()
+    assert "systems" in app.blueprints
+
+
+def test_system_handlers_callable():
+    from scribe.routes import systems as routes
+    for name in (
+        "list_systems_route", "create_system_route", "get_system_route",
+        "update_system_route", "delete_system_route", "system_records_route",
+        "project_issues_route",
+    ):
+        assert callable(getattr(routes, name))
+
+
+def test_service_functions_take_user_id():
+    """Routes must call systems services with user_id — verify the contract."""
+    from scribe.services import systems as svc
+    for fn_name in (
+        "create_system", "list_systems", "get_system", "update_system",
+        "delete_system", "list_records_for_system", "list_issues",
+        "open_issue_counts_by_system",
+    ):
+        fn = getattr(svc, fn_name)
+        assert callable(fn)
+        assert "user_id" in inspect.signature(fn).parameters