feat(issues): S1 schema — issue task_kind, System entity, associations

First slice of the Issues + Systems feature (spec #825, plan #819 T2).

Schema (migration 0065):
- task_kind CHECK expands work|plan -> work|plan|issue (same-change, rule 36)
- notes.arose_from_id: optional self-FK for issue->originating-task provenance
  (distinct from parent_id sub-task hierarchy)
- systems: per-project, self-describing (name + description) subsystem/area
- record_systems: M2M join linking any note/task/issue to systems (mutable)

Models: System + RecordSystem; note.py gains arose_from_id (+ index, to_dict).
Service services/systems.py: CRUD, archive, soft-delete, set/list associations,
records-for-system, open-issue count — all gated via services/access.py project
permissions (rule 78, no bare-owner filters). Unit tests lock the ACL gating;
the migration is exercised by CI's integration lane (alembic upgrade head).

is_task stays a derived property (status is not None) — unchanged. T1 (typing-
axis rationalization) intentionally NOT bundled; this only adds the enum value.

Refs plan 825 (S1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_services_systems.py

@@ -0,0 +1,70 @@
+"""ACL gating + field handling for services/systems.py (unit, mocked session)."""
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+
+def _make_mock_session():
+    s = AsyncMock()
+    s.__aenter__ = AsyncMock(return_value=s)
+    s.__aexit__ = AsyncMock(return_value=False)
+    s.add = MagicMock()
+    s.commit = AsyncMock()
+    s.refresh = AsyncMock()
+    return s
+
+
+@pytest.mark.asyncio
+async def test_create_system_denied_without_project_write():
+    with patch("scribe.services.systems.access") as acc:
+        acc.can_write_project = AsyncMock(return_value=False)
+        from scribe.services.systems import create_system
+        result = await create_system(user_id=1, project_id=5, name="Reader")
+    assert result is None
+
+
+@pytest.mark.asyncio
+async def test_create_system_sets_fields_when_authorized():
+    mock_session = _make_mock_session()
+    captured = {}
+
+    def _capture_add(obj):
+        captured["name"] = getattr(obj, "name", "MISSING")
+        captured["project_id"] = getattr(obj, "project_id", "MISSING")
+
+    mock_session.add = MagicMock(side_effect=_capture_add)
+    with patch("scribe.services.systems.async_session") as mock_cls, \
+         patch("scribe.services.systems.access") as acc:
+        acc.can_write_project = AsyncMock(return_value=True)
+        mock_cls.return_value = mock_session
+        from scribe.services.systems import create_system
+        await create_system(user_id=1, project_id=5, name="  Reader  ")
+    assert captured["name"] == "Reader"  # stripped
+    assert captured["project_id"] == 5
+
+
+@pytest.mark.asyncio
+async def test_set_record_systems_denied_without_note_write():
+    with patch("scribe.services.systems.access") as acc:
+        acc.can_write_note = AsyncMock(return_value=False)
+        from scribe.services.systems import set_record_systems
+        result = await set_record_systems(user_id=1, note_id=9, system_ids=[1, 2])
+    assert result is None
+
+
+@pytest.mark.asyncio
+async def test_list_systems_denied_returns_empty():
+    with patch("scribe.services.systems.access") as acc:
+        acc.can_read_project = AsyncMock(return_value=False)
+        from scribe.services.systems import list_systems
+        result = await list_systems(user_id=1, project_id=5)
+    assert result == []
+
+
+@pytest.mark.asyncio
+async def test_count_open_issues_denied_returns_zero():
+    with patch("scribe.services.systems.access") as acc:
+        acc.can_read_project = AsyncMock(return_value=False)
+        from scribe.services.systems import count_open_issues
+        result = await count_open_issues(user_id=1, project_id=5)
+    assert result == 0