feat(phase-4b): backend business-logic, 8 entities, 32 endpoints, 58 tests

tests/test_soft_delete_isolation.py

@@ -0,0 +1,29 @@
+"""Tests for soft-delete isolation (R-1)."""
+
+from __future__ import annotations
+
+import pytest
+from httpx import AsyncClient
+
+
+@pytest.mark.asyncio
+async def test_soft_deleted_records_excluded_from_queries(
+    client: AsyncClient, auth_headers: dict[str, str], seed_data: dict
+) -> None:
+    # Create a throwaway account, soft-delete it, then verify it does NOT appear in list
+    create = await client.post(
+        "/api/v1/accounts/",
+        json={"name": "Throwaway Co", "industry": "other"},
+        headers=auth_headers,
+    )
+    assert create.status_code == 201
+    acc_id = create.json()["id"]
+
+    delete = await client.delete(f"/api/v1/accounts/{acc_id}", headers=auth_headers)
+    assert delete.status_code == 204
+
+    # List accounts; the soft-deleted one must NOT appear in results
+    listed = await client.get("/api/v1/accounts/?q=Throwaway", headers=auth_headers)
+    assert listed.status_code == 200
+    ids = [a["id"] for a in listed.json()]
+    assert acc_id not in ids