Visit Stealing API

[jbcarras]

(Feature Request)
PATCH /api/steal-visit/<id>:
Has no body. Overwrite the TA ID of an in-progress visit denoted by id with the ID of the TA who hit the endpoint.
Should return a 400 Bad Request if the TA is currently in a visit and a 404 if the visit doesn't exist. 403 if the user isn't a TA or higher (this is already handled by the min_level decorator)
Should return 200 OK with the visit information in JSON (matches format of get_tas_visit) on success.

PATCH /api/abandon-visit/<id>
Has no body. Overwrite the TA ID of an in-progress visit denoted by id with null.
Should return 404 if the visit doesn't exist and 403 if the user isn't a TA or higher (this is already handled by the min_level decorator).
Should return 200 OK with success message in JSON (i.e. {"message": } on success.

[OwenPFC]

Will work on

[passionworkeer]

A clean way to implement this is to treat both endpoints as guarded state transitions on the same visit row. For steal, do a single transactional update like UPDATE visits SET ta_id = :current_user WHERE id = :id AND ended_at IS NULL and check current TA state in the same transaction so two TAs cannot steal/claim concurrently. For �bandon, clear a_id only when the visit is still active. Reusing the serializer from get_tas_visit for the success payload will also keep response shape stable and avoid drift between endpoints.