Étape 5 : API CRUD, matrice et validation branchée

- CRUD complet, scopé par édition, sur Position, Shift, Volunteer, Assignment
  (routers app/api/*, schémas Pydantic, dépendance get_edition partagée)
- Volunteer : gestion des compétences par codes (création à la volée),
  suppression = effacement complet en cascade (RGPD)
- Shift : contrôle fin > début, poste de la même édition, compétences requises
- Assignment : toute écriture active passe par le moteur de validation ;
  violation bloquante -> 422 error.validation_failed, avertissements renvoyés
  dans la réponse. Endpoint POST .../assignments/validate en simulation.
  app/validation/loader.py construit la ValidationInput depuis la base.
- GET /editions/{id}/matrix : postes -> créneaux -> {min, ideal, confirmed,
  proposed}, source de l'écran principal
- 30 tests d'API (CRUD, 404/409/422, cascade, blocage, avertissements, matrice,
  loader) ; 104 tests au total ; alembic check toujours vert
- Clés de traduction shift.* / assignment.* / volunteer.* ajoutées

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017uUsRg7XzopkCPWimwg9ZM

backend/app/api/positions.py

@@ -0,0 +1,79 @@
+"""CRUD des postes."""
+
+import uuid
+
+from fastapi import APIRouter, Depends, Response, status
+from sqlmodel import Session, select
+
+from app.api._common import owned_or_404
+from app.api.deps import get_edition
+from app.api.schemas import PositionCreate, PositionRead, PositionUpdate
+from app.db import get_session
+from app.models import Edition, Position
+
+router = APIRouter(
+    prefix="/editions/{edition_id}/positions", tags=["positions"]
+)
+
+
+@router.post("", response_model=PositionRead, status_code=status.HTTP_201_CREATED)
+def create_position(
+    payload: PositionCreate,
+    edition: Edition = Depends(get_edition),
+    session: Session = Depends(get_session),
+) -> Position:
+    position = Position(edition_id=edition.id, **payload.model_dump())
+    session.add(position)
+    session.commit()
+    session.refresh(position)
+    return position
+
+
+@router.get("", response_model=list[PositionRead])
+def list_positions(
+    edition: Edition = Depends(get_edition),
+    session: Session = Depends(get_session),
+) -> list[Position]:
+    return list(
+        session.exec(
+            select(Position)
+            .where(Position.edition_id == edition.id)
+            .order_by(Position.name)
+        )
+    )
+
+
+@router.get("/{position_id}", response_model=PositionRead)
+def get_position(
+    position_id: uuid.UUID,
+    edition: Edition = Depends(get_edition),
+    session: Session = Depends(get_session),
+) -> Position:
+    return owned_or_404(session.get(Position, position_id), edition.id)
+
+
+@router.patch("/{position_id}", response_model=PositionRead)
+def update_position(
+    position_id: uuid.UUID,
+    payload: PositionUpdate,
+    edition: Edition = Depends(get_edition),
+    session: Session = Depends(get_session),
+) -> Position:
+    position = owned_or_404(session.get(Position, position_id), edition.id)
+    for field, value in payload.model_dump(exclude_unset=True).items():
+        setattr(position, field, value)
+    session.commit()
+    session.refresh(position)
+    return position
+
+
+@router.delete("/{position_id}", status_code=status.HTTP_204_NO_CONTENT)
+def delete_position(
+    position_id: uuid.UUID,
+    edition: Edition = Depends(get_edition),
+    session: Session = Depends(get_session),
+) -> Response:
+    position = owned_or_404(session.get(Position, position_id), edition.id)
+    session.delete(position)
+    session.commit()
+    return Response(status_code=status.HTTP_204_NO_CONTENT)