feat(mvp): Phase 1 control layer + API vertical slice

Implements the Phase 1 MVP from the README: a stateless control layer + HTTP
API over a centralized database, with hook-enforced test/push gates.

- DB layer: SQLAlchemy Core, one schema rendering both Postgres (BIGSERIAL /
  TIMESTAMPTZ / JSONB) and SQLite (INTEGER PK / TEXT / JSON) via portable types;
  native ON CONFLICT DO UPDATE checkmark upsert on both dialects.
- Alembic dual-dialect migrations (render_as_batch for SQLite); tests run a real
  `alembic upgrade head`.
- FastAPI: projects/agents/checkmark/log/answer/resume + shared log/context
  routes, single global bearer token, higher-trust token gating shared-context
  writes, project isolation on every route.
- Hooks (`python -m handler.hooks <event>`): Stop test gate (block on red),
  PreToolUse AskUserQuestion defer + `git push` gate (tests then throwaway
  build), Notification generic webhook (no-op without WEBHOOK_URL). Identity via
  env injected at spawn; verify is the mock seam.
- Control CLI: spawn/list/attach/kill, hard `.mise.toml [tasks.test]` gate,
  generated per-agent settings.json, identity + DATABASE_URL injected via tmux;
  tmux is the mock seam.
- 45 tests (SQLite), ruff clean. Live claude/tmux/mise spawning deferred behind
  the mocked seams.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W5ZuS5pV1NS6eKsRZHXonY

tests/test_api_shared.py

@@ -0,0 +1,40 @@
+"""Shared-context + shared-log endpoints and the write-token gate."""
+
+from __future__ import annotations
+
+from handler.db import repository as repo
+from handler.db.engine import get_engine
+
+
+def test_put_shared_context_requires_write_token(client, auth, env):
+    # The normal token is not enough to write shared context.
+    r = client.put("/shared/context/schema_version", json={"value": "v3"}, headers=auth)
+    assert r.status_code == 403
+
+    write_headers = {"Authorization": f"Bearer {env['shared_token']}"}
+    r = client.put(
+        "/shared/context/schema_version", json={"value": "v3"}, headers=write_headers
+    )
+    assert r.status_code == 200
+    assert r.json()["value"] == "v3"
+
+
+def test_read_shared_context_uses_normal_token(client, auth, env):
+    write_headers = {"Authorization": f"Bearer {env['shared_token']}"}
+    client.put("/shared/context/k", json={"value": "v"}, headers=write_headers)
+
+    assert client.get("/shared/context", headers=auth).status_code == 200
+    assert client.get("/shared/context/k", headers=auth).json()["value"] == "v"
+    assert client.get("/shared/context/missing", headers=auth).status_code == 404
+
+
+def test_shared_log_returns_only_global(client, auth, env):
+    with get_engine().begin() as conn:
+        repo.create_project(conn, "p", "/tmp/p")
+        a = repo.create_agent(conn, "p", "a", "/tmp/p/a")
+        repo.insert_log_entry(conn, a["id"], status="working", summary="private")
+        repo.insert_log_entry(
+            conn, a["id"], status="working", summary="global-note", visibility="global"
+        )
+    entries = client.get("/shared/log", headers=auth).json()
+    assert [e["summary"] for e in entries] == ["global-note"]