feat: neuroglancer view (2/6): API — CRUD, read link, delete guard

[allison-truhlar]

Neuroglancer Views — PR 2 of 6 (stacked)

The HTTP layer for Neuroglancer Views, stacked on #422 (PR 1, data model).
Backend-only; no frontend, no schema change / no migration.

Base: merge #422 first — this PR targets ngviews-01-model.

What's in this PR

• Owner CRUD /api/neuroglancer/views — POST (client-built ng_state +
  layer list; resolves each layer's Data Link sharing_key → id), GET (list),
  GET/{short_key}, PUT/{short_key} (rename/restate), DELETE/{short_key}.
  All owner-scoped; View responses never expose edit_key.
• Public read link GET /ngview/{key} — resolves by read_key, serves the
  View's ng_state JSON (Cache-Control: no-store) for the embedded NG iframe
  (PR 6). Read-only, unauthenticated, mirrors the existing /ng/{short_key}.
• Dependent-Views discovery GET /api/proxied-path/{sharing_key}/views —
  the caller's own Views backed by a Data Link (powers the delete dialog and the
  Properties "Appears in N Views" in PR 5).
• Data Link delete guard — DELETE /api/proxied-path/{sharing_key} takes a
  confirm flag; returns 409 with the caller's own dependent Views when
  unconfirmed; on confirm marks all layers on the link broken and deletes it.
• Request models + sharing_mode → Literal['private','read']; two DB helpers
  (mark_view_layers_broken, owner-filtered get_views_for_data_link).

Review decisions (product calls made during review)

• No cross-user data loss/leak. Deleting a Data Link never cascade-deletes
  Views. The 409 list and dependent-views endpoint are owner-scoped — other
  users' Views are never disclosed. On confirm, all layers on the link are
  marked broken (any owner, for referential integrity) so other users' Views
  degrade gracefully and surface as broken when opened. Follow-up: a broken
  indicator in the other user's Data Links table.
• sharing_mode is not enforced yet — every View is readable by its
  read_key (bearer token); 'private' is a stored label only. Follow-up: a
  future PR adds 'public' (unauthenticated / listed) viewing + enforcement.
• 409 envelope note for PR 5: this route returns {"detail": {message, dependent_views}}, unlike the app's usual {"error": str} (the global
  exception handler stringifies dict details, so the route returns a
  JSONResponse directly).

Testing

pixi run -e test test-backend → 787 passed. Covers CRUD round-trip +
owner-scoping 404s, unknown-sharing-key 400, /ngview read-key resolution
(short_key rejected, unknown 404, no-store), the owner-filtered dependent
lookup, and the delete guard (409 lists only own Views → confirm marks the
layer broken + deletes the link).

Stack

1. feat: neuroglancer view (1/6): data model — views + view_layers tables #422 — data model
2. This PR — API
3. Multi-select · 4. Views page · 5. Browser entry points · 6. Read-only embedded viewer