feat(state-hub): add Extension Points and Technical Debt tracking

New entity types (DB tables, API routers, Pydantic schemas, Alembic
migration a3f1c2d4e5b6):
- extension_points: ep_id, domain, title, ep_type, status, priority,
  location, description, topic_id, workstream_id
- technical_debt: td_id, domain, title, debt_type, severity, status,
  location, description, topic_id, workstream_id

MCP server: 6 new tools — register_extension_point, list_extension_points,
update_ep_status, register_technical_debt, list_technical_debt,
update_td_status (each write emits a progress_event)

Dashboard: two new pages (extensions.md, techdept.md) with KPI sidebar,
charts, urgent-items section, and filterable card lists. Both added to
nav in observablehq.config.js.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/technical_debt.py

@@ -0,0 +1,86 @@
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from api.database import get_session
+from api.models.technical_debt import TDStatus, TechnicalDebt
+from api.schemas.technical_debt import TDCreate, TDRead, TDUpdate
+
+router = APIRouter(prefix="/technical-debt", tags=["technical-debt"])
+
+
+@router.get("/", response_model=list[TDRead])
+async def list_td(
+    domain: str | None = None,
+    status: TDStatus | None = None,
+    debt_type: str | None = None,
+    severity: str | None = None,
+    session: AsyncSession = Depends(get_session),
+) -> list[TechnicalDebt]:
+    q = select(TechnicalDebt)
+    if domain:
+        q = q.where(TechnicalDebt.domain == domain)
+    if status:
+        q = q.where(TechnicalDebt.status == status)
+    if debt_type:
+        q = q.where(TechnicalDebt.debt_type == debt_type)
+    if severity:
+        q = q.where(TechnicalDebt.severity == severity)
+    q = q.order_by(TechnicalDebt.created_at)
+    result = await session.execute(q)
+    return list(result.scalars().all())
+
+
+@router.post("/", response_model=TDRead, status_code=status.HTTP_201_CREATED)
+async def create_td(
+    body: TDCreate,
+    session: AsyncSession = Depends(get_session),
+) -> TechnicalDebt:
+    td = TechnicalDebt(**body.model_dump())
+    session.add(td)
+    await session.commit()
+    await session.refresh(td)
+    return td
+
+
+@router.get("/{td_id}", response_model=TDRead)
+async def get_td(
+    td_id: uuid.UUID,
+    session: AsyncSession = Depends(get_session),
+) -> TechnicalDebt:
+    td = await session.get(TechnicalDebt, td_id)
+    if td is None:
+        raise HTTPException(status_code=404, detail="Technical debt item not found")
+    return td
+
+
+@router.patch("/{td_id}", response_model=TDRead)
+async def update_td(
+    td_id: uuid.UUID,
+    body: TDUpdate,
+    session: AsyncSession = Depends(get_session),
+) -> TechnicalDebt:
+    td = await session.get(TechnicalDebt, td_id)
+    if td is None:
+        raise HTTPException(status_code=404, detail="Technical debt item not found")
+    for field, value in body.model_dump(exclude_unset=True).items():
+        setattr(td, field, value)
+    await session.commit()
+    await session.refresh(td)
+    return td
+
+
+@router.delete("/{td_id}", response_model=TDRead)
+async def defer_td(
+    td_id: uuid.UUID,
+    session: AsyncSession = Depends(get_session),
+) -> TechnicalDebt:
+    td = await session.get(TechnicalDebt, td_id)
+    if td is None:
+        raise HTTPException(status_code=404, detail="Technical debt item not found")
+    td.status = TDStatus.deferred
+    await session.commit()
+    await session.refresh(td)
+    return td