Require claims on publish and fix nil-gap in consistency check

[rdimitrov]

Summary

• Reject publish requests (POST /v1/entries) that omit claims when authentication is enabled (JWT present) — returns 400 Bad Request
• Fix the claim consistency check on subsequent publishes to catch asymmetric nil/non-nil mismatches — returns 409 Conflict
• Extract the inline claim consistency logic into a shared checkClaimConsistency helper used by both MCP and skills publish paths

Problem

Two related bugs in the publish endpoint:

1. Claims not required when auth is on. Publishing without claims creates an entry with NULL claims in the database. The per-user filter (checkClaims) returns false for empty recordJSON, making these entries invisible to all non-super-admin users — permanently dead entries with no error signal.

2. Nil-gap in claim consistency check. The guard if claimsJSON != nil && existing.Claims != nil only fires when both sides are non-nil. Publishing without claims against an entry that has claims (or vice versa) silently succeeds with 201, giving the publisher no indication of the inconsistency.

Changes

File	Change
internal/api/v1/entries.go	Add claims-required guard when JWT is present
internal/service/db/claims_filter.go	Add checkClaimConsistency with symmetric nil handling
internal/service/db/impl_mcp.go	Replace inline check with checkClaimConsistency call
internal/service/db/impl_skills.go	Replace inline check with checkClaimConsistency call
internal/api/v1/entries_test.go	3 test cases for the API guard
internal/service/db/claims_filter_validate_test.go	8 test cases for checkClaimConsistency

Test plan

• TestPublishEntryClaimsRequired — authenticated without claims → 400, with claims → 201, unauthenticated without claims → 201
• TestCheckClaimConsistency — both nil, both empty, asymmetric nil (both directions), identical claims, different values, extra keys (both directions)
• Existing TestPublishServerVersion_ClaimsSubset and TestPublishSkill_ClaimsSubset still pass
• Existing TestDeleteServerVersion_ClaimsAuthorization and TestDeleteSkillVersion_ClaimsAuthorization still pass
• Lint passes (task lint-fix)

Fixes #726

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 75.60976% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.34%. Comparing base (e9ccced) to head (8e5c713).

Files with missing lines	Patch %	Lines
internal/service/db/claims_filter.go	73.33%	2 Missing and 2 partials ⚠️
internal/api/server.go	33.33%	2 Missing ⚠️
internal/service/db/impl_mcp.go	0.00%	1 Missing and 1 partial ⚠️
internal/service/db/impl_skills.go	0.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #727      +/-   ##
==========================================
+ Coverage   59.80%   60.34%   +0.54%     
==========================================
  Files         106      106              
  Lines       10306    10325      +19     
==========================================
+ Hits         6163     6231      +68     
+ Misses       3600     3550      -50     
- Partials      543      544       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.