Full-CRUD sweep: update endpoints for tree, source, citation, relationship, media

Closes the rule #8 gap at the API layer: PATCH endpoints + service updates for Tree (name/description/visibility), Source, Citation (page/detail/confidence), Relationship (qualifier/notes), and Media (title/attachment) — editor-gated and audited. Every core entity now has create/read/update/delete. Edit UIs for these land in the frontend batch. 37 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/app/api/v1/media.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, File, Form, Response, UploadFile, status
 
 from app.api.deps import CurrentUser, ObjectStoreDep, SessionDep
-from app.schemas.media import MediaRead
+from app.schemas.media import MediaRead, MediaUpdate
 from app.services import media_service, tree_service
 
 
@@ -81,6 +81,26 @@ async def media_content(
     )
 
 
+@router.patch("/{tree_id}/media/{media_id}", response_model=MediaRead)
+async def update_media(
+    tree_id: uuid.UUID,
+    media_id: uuid.UUID,
+    data: MediaUpdate,
+    session: SessionDep,
+    current: CurrentUser,
+    store: ObjectStoreDep,
+) -> MediaRead:
+    tree = await tree_service.get_tree(session, viewer_id=current.id, tree_id=tree_id)
+    media = await media_service.update_media(
+        session,
+        actor=current,
+        tree=tree,
+        media_id=media_id,
+        changes=data.model_dump(exclude_unset=True),
+    )
+    return _read(media)
+
+
 @router.delete("/{tree_id}/media/{media_id}", status_code=status.HTTP_204_NO_CONTENT)
 async def delete_media(
     tree_id: uuid.UUID, media_id: uuid.UUID, session: SessionDep, current: CurrentUser