feat(gems): three-pass schema migration aligning state-hub with GEMS

Implements CUST-WP-0007. Resolves inconsistencies I-1, I-2, I-5, I-6
identified in the GEMS audit (GenericEntityModellingSystem.md).

Pass 1 (e1f2a3b4c5d6): domain_id FK on extension_points and
technical_debt (replaces raw string column); repo_id FK on contributions.
Fixes domain-filtering bugs in EP/TD dashboard pages.

Pass 2 (f2a3b4c5d6e7): repo_id nullable FK on workstreams, aligning
the GEMS primary attachment with ADR-001 (repo > topic). Dashboard
pages updated to prefer repo->domain over topic->domain.

Pass 3 (a3b4c5d6e7f8): SBOMSnapshot container entity (GEMS Complex
between Repository and SBOMEntry). Ingest is now additive — each call
creates a new snapshot; history is retained. List/report endpoints
filter to latest snapshot per repo via _latest_snapshot_ids_subquery().
New endpoints: GET /sbom/snapshots/, GET /sbom/snapshots/{id}/.
Dashboard gains a Snapshot History section.

Also adds GEMS analysis artefacts: wiki/GEMS-StateHub-TypeRegistry.md,
wiki/GEMS-StateHub-SWOT.md, workplans/CUST-WP-0006 (analysis),
workplans/CUST-WP-0007 (migration, now completed).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/schemas/contribution.py

@@ -15,6 +15,7 @@ class ContributionCreate(BaseModel):
     body_path: str | None = None
     related_topic_id: uuid.UUID | None = None
     related_workstream_id: uuid.UUID | None = None
+    repo_id: uuid.UUID | None = None
     notes: str | None = None
 
 
@@ -36,6 +37,7 @@ class ContributionRead(BaseModel):
     body_path: str | None = None
     related_topic_id: uuid.UUID | None = None
     related_workstream_id: uuid.UUID | None = None
+    repo_id: uuid.UUID | None = None
     submitted_at: datetime | None = None
     resolved_at: datetime | None = None
     notes: str | None = None

api/schemas/extension_point.py

@@ -10,7 +10,7 @@ VALID_PRIORITIES = {"low", "medium", "high", "critical"}
 
 class EPCreate(BaseModel):
     ep_id: str | None = None
-    domain: str
+    domain: str  # slug; router resolves to domain_id FK
     title: str
     description: str | None = None
     location: str | None = None
@@ -36,7 +36,7 @@ class EPRead(BaseModel):
 
     id: uuid.UUID
     ep_id: str | None = None
-    domain: str
+    domain_slug: str  # derived from domain relationship
     title: str
     description: str | None = None
     location: str | None = None

api/schemas/managed_repo.py

@@ -26,6 +26,7 @@ class RepoRead(BaseModel):
     model_config = ConfigDict(from_attributes=True)
     id: uuid.UUID
     domain_id: uuid.UUID
+    domain_slug: str  # derived from domain relationship
     slug: str
     name: str
     local_path: str | None = None

api/schemas/sbom.py

@@ -25,6 +25,7 @@ class SBOMEntryRead(BaseModel):
 
     id: uuid.UUID
     repo_id: uuid.UUID
+    snapshot_id: uuid.UUID
     package_name: str
     package_version: str | None = None
     ecosystem: Ecosystem
@@ -35,6 +36,29 @@ class SBOMEntryRead(BaseModel):
     created_at: datetime
 
 
+class SBOMSnapshotRead(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    repo_id: uuid.UUID
+    snapshot_at: datetime
+    source: str | None = None
+    entry_count: int
+    created_at: datetime
+
+
+class SBOMSnapshotDetail(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    repo_id: uuid.UUID
+    snapshot_at: datetime
+    source: str | None = None
+    entry_count: int
+    created_at: datetime
+    entries: list[SBOMEntryRead] = []
+
+
 class LicenceGroup(BaseModel):
     license_spdx: str | None
     count: int

api/schemas/technical_debt.py

@@ -10,7 +10,7 @@ VALID_SEVERITIES = {"low", "medium", "high", "critical"}
 
 class TDCreate(BaseModel):
     td_id: str | None = None
-    domain: str
+    domain: str  # slug; router resolves to domain_id FK
     title: str
     description: str | None = None
     location: str | None = None
@@ -36,7 +36,7 @@ class TDRead(BaseModel):
 
     id: uuid.UUID
     td_id: str | None = None
-    domain: str
+    domain_slug: str  # derived from domain relationship
     title: str
     description: str | None = None
     location: str | None = None

api/schemas/workstream.py

@@ -15,6 +15,7 @@ class WorkstreamCreate(BaseModel):
     status: WorkstreamStatus = WorkstreamStatus.active
     owner: str | None = None
     due_date: date | None = None
+    repo_id: uuid.UUID | None = None  # GEMS primary: the owning repository
 
 
 class WorkstreamUpdate(BaseModel):
@@ -23,12 +24,14 @@ class WorkstreamUpdate(BaseModel):
     status: WorkstreamStatus | None = None
     owner: str | None = None
     due_date: date | None = None
+    repo_id: uuid.UUID | None = None
 
 
 class WorkstreamRead(BaseModel):
     model_config = ConfigDict(from_attributes=True)
     id: uuid.UUID
     topic_id: uuid.UUID
+    repo_id: uuid.UUID | None = None
     slug: str
     title: str
     description: str | None = None