Todo description, entity codes, REST API extensions and Claude Code hardening (ST-509/511/512/513) (#2)

* docs(ST-511): add backlog entry for entity codes feature

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ST-511): add createWithCodeRetry helper to handle P2002 race on auto codes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ST-511): retry on auto-code unique conflict in story and pbi create

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ST-511): surface field errors for code and title in PBI dialog

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ST-511): read create-state errors in Story dialog fieldError

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(ST-512): add backlog entry for REST API code/description/implementation_plan extensions; mark ST-511 done

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ST-512): extend REST API with code, description and implementation_plan

- GET /api/products returns code, description and definition_of_done
- GET /api/products/:id/next-story returns story.code and per-task code + implementation_plan
- GET /api/sprints/:id/tasks returns description, implementation_plan, story_code and derived per-task code
- POST /api/todos accepts and returns optional description (max 2000)

All changes are additive — existing clients ignore unknown keys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(ST-512): mark ST-512 as done

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(ST-513): add backlog entry for API hardening for Claude Code

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ST-513): add task and story status mappers for API boundary

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ST-513): expose lowercase status on API and accept lowercase in PATCH /api/tasks

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ST-513): add metadata JSONB column to StoryLog

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ST-513): accept optional metadata in story log and switch validation errors to 422

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ST-513): add GET /api/health endpoint with optional db ping

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(ST-513): add GET /api/products/:id/claude-context bundled endpoint

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(ST-513): add docs/API.md and link from CLAUDE.md specs table

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(ST-513): mark ST-513 as done

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(ST-513): split 400 (malformed JSON) from 422 (validation), reject 'review'

Codex review on PR #2:

- P2.1: routes treated JSON parse failures as 422 instead of 400, breaking
  the contract in docs/API.md. Replace `request.json().catch(() => null)`
  with try/catch in 4 routes (tasks, reorder, todos, story-log) so a
  malformed body returns 400 and only well-formed-but-invalid bodies
  return 422.

- P2.2: PATCH /api/tasks/:id accepted `status: "review"`, but the sprint
  task list UI does not render REVIEW (no label/color, the cycle helper
  falls back to TO_DO). Reject `review` at the API until the sprint UI
  is extended; document the subset in docs/API.md.

Tests in __tests__/api updated for the new contract (29 assertions:
zod-failures now expect 422, status payloads use lowercase API values,
sprint-tasks mocks include the new story relation).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

components/backlog/pbi-dialog.tsx

@@ -79,9 +79,13 @@ export function PbiDialog({ state, onClose }: PbiDialogProps) {
     undefined
   )
 
-  const error = isEdit
-    ? (typeof updateState?.error === 'string' ? updateState.error : null)
-    : (typeof createState?.error === 'string' ? createState.error : null)
+  const activeState = isEdit ? updateState : createState
+  const error = typeof activeState?.error === 'string' ? activeState.error : null
+  const fieldError = (field: string) => {
+    const err = activeState?.error
+    if (!err || typeof err === 'string') return undefined
+    return (err as Record<string, string[]>)[field]?.[0]
+  }
 
   const titleRef = useRef<HTMLInputElement>(null)
   useEffect(() => {
@@ -111,8 +115,9 @@ export function PbiDialog({ state, onClose }: PbiDialogProps) {
                 defaultValue={pbi?.code ?? ''}
                 placeholder={isEdit ? '' : 'auto'}
                 maxLength={30}
-                className="font-mono text-sm"
+                className={fieldError('code') ? 'font-mono text-sm border-error' : 'font-mono text-sm'}
               />
+              {fieldError('code') && <p className="text-xs text-error">{fieldError('code')}</p>}
             </div>
             <div className="grid gap-1.5">
               <label htmlFor="pbi-title" className="text-sm font-medium">Titel</label>
@@ -124,7 +129,9 @@ export function PbiDialog({ state, onClose }: PbiDialogProps) {
                 placeholder="PBI-titel…"
                 required
                 maxLength={200}
+                className={fieldError('title') ? 'border-error' : ''}
               />
+              {fieldError('title') && <p className="text-xs text-error">{fieldError('title')}</p>}
             </div>
           </div>
 

components/backlog/story-dialog.tsx

@@ -98,7 +98,8 @@ export function StoryDialog({ state, onClose, isDemo = false }: StoryDialogProps
   )
 
   const fieldError = (field: string) => {
-    const err = updateResult?.error
+    const result = isEdit ? updateResult : createResult
+    const err = result?.error
     if (!err || typeof err === 'string') return undefined
     return (err as Record<string, string[]>)[field]?.[0]
   }