Full-CRUD sweep: update endpoints for tree, source, citation, relationship, media

Closes the rule #8 gap at the API layer: PATCH endpoints + service updates for Tree (name/description/visibility), Source, Citation (page/detail/confidence), Relationship (qualifier/notes), and Media (title/attachment) — editor-gated and audited. Every core entity now has create/read/update/delete. Edit UIs for these land in the frontend batch. 37 tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Paul <justin@jpaul.me>

backend/app/services/citation_service.py

@@ -113,6 +113,38 @@ async def list_citations(
     return list((await session.execute(stmt)).scalars().all())
 
 
+async def update_citation(
+    session: AsyncSession, *, actor: User, tree: Tree, citation_id: uuid.UUID, changes: dict
+) -> Citation:
+    if not await privacy.can_edit_tree(session, user_id=actor.id, tree=tree):
+        raise Forbidden("not an editor of this tree")
+    citation = (
+        await session.execute(
+            select(Citation).where(
+                Citation.id == citation_id,
+                Citation.tree_id == tree.id,
+                Citation.deleted_at.is_(None),
+            )
+        )
+    ).scalar_one_or_none()
+    if citation is None:
+        raise NotFound("citation not found")
+    for key in {"page", "detail", "confidence"} & changes.keys():
+        setattr(citation, key, changes[key])
+    record_audit(
+        session,
+        action="update",
+        entity_type="Citation",
+        entity_id=citation.id,
+        tree_id=tree.id,
+        actor_user_id=actor.id,
+        after=changes,
+    )
+    await session.commit()
+    await session.refresh(citation)
+    return citation
+
+
 async def delete_citation(
     session: AsyncSession, *, actor: User, tree: Tree, citation_id: uuid.UUID
 ) -> None: