feat(state-hub): v0.3 schema — contributions + sbom_entries migrations, models, schemas, routers

Migrations (chain: b1c2d3e4f5a6 → c2d3e4f5a6b7 → d3e4f5a6b7c8):
- c2d3e4f5a6b7: contributions table (contributiontype BR/FR/EP/UPR enum,
  contributionstatus 7-state lifecycle, FKs to topics/workstreams)
- d3e4f5a6b7c8: sbom_entries table (ecosystem enum, snapshot-based replacement),
  + sbom_source + last_sbom_at columns on managed_repos

New models: Contribution (ContributionType, ContributionStatus), SBOMEntry (Ecosystem)
Modified: ManagedRepo (sbom_source, last_sbom_at columns)

New routers:
- /contributions/ — CRUD + lifecycle-guarded PATCH /status + soft-delete (withdrawn)
- /sbom/ — ingest (replace snapshot), list, per-repo view, licence report

Modified:
- /state/summary now includes contribution_counts and licence_risk_count
- main.py: registers contributions + sbom routers; bumps version to 0.6.0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/models/contribution.py

@@ -0,0 +1,62 @@
+import enum
+import uuid
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, Enum, ForeignKey, String, Text
+from sqlalchemy.dialects.postgresql import UUID
+from sqlalchemy.orm import Mapped, mapped_column, relationship
+
+from api.models.base import Base, TimestampMixin, new_uuid
+
+
+class ContributionType(str, enum.Enum):
+    br = "br"
+    fr = "fr"
+    ep = "ep"
+    upr = "upr"
+
+
+class ContributionStatus(str, enum.Enum):
+    draft = "draft"
+    submitted = "submitted"
+    acknowledged = "acknowledged"
+    accepted = "accepted"
+    rejected = "rejected"
+    merged = "merged"
+    withdrawn = "withdrawn"
+
+
+class Contribution(Base, TimestampMixin):
+    __tablename__ = "contributions"
+
+    id: Mapped[uuid.UUID] = mapped_column(
+        UUID(as_uuid=True), primary_key=True, default=new_uuid
+    )
+    type: Mapped[ContributionType] = mapped_column(
+        Enum(ContributionType, name="contributiontype"), nullable=False
+    )
+    target_org: Mapped[str | None] = mapped_column(String(200), nullable=True)
+    target_repo: Mapped[str | None] = mapped_column(String(200), nullable=True)
+    slug: Mapped[str | None] = mapped_column(String(200), nullable=True)
+    title: Mapped[str] = mapped_column(String(500), nullable=False)
+    status: Mapped[ContributionStatus] = mapped_column(
+        Enum(ContributionStatus, name="contributionstatus"),
+        nullable=False, default=ContributionStatus.draft,
+    )
+    body_path: Mapped[str | None] = mapped_column(Text, nullable=True)
+    related_topic_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("topics.id", ondelete="SET NULL"), nullable=True
+    )
+    related_workstream_id: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True), ForeignKey("workstreams.id", ondelete="SET NULL"), nullable=True
+    )
+    submitted_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    resolved_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    notes: Mapped[str | None] = mapped_column(Text, nullable=True)
+
+    topic: Mapped["Topic"] = relationship("Topic", lazy="selectin")  # noqa: F821
+    workstream: Mapped["Workstream"] = relationship("Workstream", lazy="selectin")  # noqa: F821