feat(todo-api): add full-stack POC demonstrating micro-lib v0.9.0

Runnable REST API exercising every micro-lib tier in a containerless setup: N-layer architecture, SQLite persistence, header-based auth simulating Firebase output, and bit-mask RBAC enforcement.

What's included:
- cmd/todo-api: minimal main delegating to application.Run
- internal/application: full object graph wiring — launcher, sqlite, httpserver, httpmw stack, routes in BeforeStart
- internal/domain: User entity, ResourceTodos constant, PermReadTodo/PermWriteTodo bit positions
- internal/repository: TodoRepository, UserRepository, DBPermissionProvider (SQLite via modernc)
- internal/service: TodoService, UserService with interface-based dependencies
- internal/handler: TodoHandler, UserHandler using httputil adapters and valid for input validation
- internal/middleware: Auth (X-User-ID → rbac.Identity) and Require (bit-mask permission gate)
- logAdapter: bridges logz.Logger.With return type to httpmw.Logger interface
- SQLite schema: users, user_role (bitmask), todos; migrations run in BeforeStart
- Routes: POST /users (open), GET+POST /todos (RBAC), GET /users (RBAC)

Tested-via: todo-api POC integration
Reviewed-against: docs/adr/

internal/handler/todo_handler.go

@@ -0,0 +1,31 @@
+package handler
+
+import (
+	"net/http"
+
+	"code.nochebuena.dev/go/httputil"
+	"code.nochebuena.dev/go/valid"
+	"code.nochebuena.dev/go/todo-api/internal/domain"
+	"code.nochebuena.dev/go/todo-api/internal/service"
+)
+
+// TodoHandler wires HTTP requests to the TodoService.
+type TodoHandler struct {
+	svc service.TodoService
+	v   valid.Validator
+}
+
+// NewTodoHandler returns a TodoHandler.
+func NewTodoHandler(svc service.TodoService, v valid.Validator) *TodoHandler {
+	return &TodoHandler{svc: svc, v: v}
+}
+
+// FindAll handles GET /todos — returns all todos as JSON.
+func (h *TodoHandler) FindAll(w http.ResponseWriter, r *http.Request) {
+	httputil.HandleNoBody[[]domain.Todo](h.svc.FindAll).ServeHTTP(w, r)
+}
+
+// Create handles POST /todos — creates a new todo from the JSON body.
+func (h *TodoHandler) Create(w http.ResponseWriter, r *http.Request) {
+	httputil.Handle[service.CreateTodoRequest, domain.Todo](h.v, h.svc.Create).ServeHTTP(w, r)
+}

internal/handler/user_handler.go

@@ -0,0 +1,31 @@
+package handler
+
+import (
+	"net/http"
+
+	"code.nochebuena.dev/go/httputil"
+	"code.nochebuena.dev/go/valid"
+	"code.nochebuena.dev/go/todo-api/internal/domain"
+	"code.nochebuena.dev/go/todo-api/internal/service"
+)
+
+// UserHandler wires HTTP requests to UserService.
+type UserHandler struct {
+	svc service.UserService
+	v   valid.Validator
+}
+
+// NewUserHandler returns a UserHandler.
+func NewUserHandler(svc service.UserService, v valid.Validator) *UserHandler {
+	return &UserHandler{svc: svc, v: v}
+}
+
+// FindAll handles GET /users — returns all users as JSON.
+func (h *UserHandler) FindAll(w http.ResponseWriter, r *http.Request) {
+	httputil.HandleNoBody[[]domain.User](h.svc.FindAll).ServeHTTP(w, r)
+}
+
+// Create handles POST /users — creates a new user with optional permission bits.
+func (h *UserHandler) Create(w http.ResponseWriter, r *http.Request) {
+	httputil.Handle[service.CreateUserRequest, domain.User](h.v, h.svc.Create).ServeHTTP(w, r)
+}