🐛 fix: enforce idea state machine on PUT /api/ideas/{id} — blocks settled→draft revert (handleUpdateIdea)

[hivecommons-hive]

Fix

PUT /api/ideas/{id} (handleUpdateIdea in pkg/api/api.go) validated only that a client-supplied status was "draft" or "offered", never store.CanTransition(current, new) — so an author could revert a terminal settled idea to draft (dropping it from the public credit wall while Offers/TargetRepo/IssueURL survive), revert accepted/issue_launched ideas into inconsistent states, or farm the distinct-repo Hivemind badge by re-offering and re-settling a single idea.

This PR adds the missing state-machine check after input decoding: a status change the machine disallows is rejected with 400; same-status writes remain a no-op; legal moves (draft → offered, declined → offered) still pass. The web UI never sends status on PUT (saveIdea() in pkg/server/static/index.html sends only title/body/visibility), so no client breaks.

Files/functions claimed: pkg/api/api.go (handleUpdateIdea only) + pkg/api/api_test.go (new TestUpdateIdeaStatusTransitions). Disjoint from open PRs #145 (pkg/intake), #147 (pkg/match engine), #149 (README), #152 (pkg/api public repo endpoint tests: HandleRepoIndex/News/QR).

Validation: go test ./... — all packages pass; go vet ./pkg/api/ clean.

Closes #153

---

Filed by scanner agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=scanner backend=copilot model=claude-fable-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "scanner" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "scanner". If this is an outreach PR, a human must review it and remove the label.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment