iObj: initial service — FastAPI + TinyDB memory object store

- Month-sharded TinyDB storage with search/filter (type, project, tag, date range, free-text)
- FastAPI app with bearer-token auth, CRUD + search endpoints
- 27 passing pytest tests (storage + API)
- Dockerfile + Nomad job spec + Gitea Actions deploy workflow (mirrors devops-mcp pattern)

tests/test_api.py

@@ -0,0 +1,135 @@
+import tempfile
+from datetime import date
+
+import pytest
+from fastapi.testclient import TestClient
+
+import iobj.app as app_module
+from iobj.storage import ObjectStore
+
+
+@pytest.fixture
+def client(monkeypatch):
+    with tempfile.TemporaryDirectory() as tmp:
+        monkeypatch.setattr(app_module, "store", ObjectStore(tmp))
+        monkeypatch.setattr(app_module, "API_TOKEN", "secret-token")
+        with TestClient(app_module.app) as c:
+            yield c
+
+
+AUTH = {"Authorization": "Bearer secret-token"}
+
+
+def test_health_no_auth_required(client):
+    resp = client.get("/health")
+    assert resp.status_code == 200
+    assert resp.json() == {"status": "ok"}
+
+
+def test_create_requires_auth(client):
+    resp = client.post("/objects", json={"type": "recap", "title": "x"})
+    assert resp.status_code == 401
+
+
+def test_create_with_wrong_token_rejected(client):
+    resp = client.post(
+        "/objects",
+        json={"type": "recap", "title": "x"},
+        headers={"Authorization": "Bearer wrong"},
+    )
+    assert resp.status_code == 401
+
+
+def test_create_and_get_object(client):
+    resp = client.post(
+        "/objects",
+        json={
+            "type": "recap",
+            "object_date": "2026-07-01",
+            "project": "NordBytes",
+            "tags": ["frontend"],
+            "title": "Test",
+            "body": "body text",
+        },
+        headers=AUTH,
+    )
+    assert resp.status_code == 200
+    obj = resp.json()
+    assert obj["title"] == "Test"
+    obj_id = obj["id"]
+
+    resp = client.get(f"/objects/{obj_id}", headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["id"] == obj_id
+
+
+def test_get_missing_object_404(client):
+    resp = client.get("/objects/does-not-exist", headers=AUTH)
+    assert resp.status_code == 404
+
+
+def test_search_objects(client):
+    client.post(
+        "/objects",
+        json={"type": "git_commit", "object_date": "2026-05-01", "title": "commit a", "project": "Egmont"},
+        headers=AUTH,
+    )
+    client.post(
+        "/objects",
+        json={"type": "recap", "object_date": "2026-05-01", "title": "recap a", "project": "NordBytes"},
+        headers=AUTH,
+    )
+    resp = client.get("/objects", params={"type": "git_commit"}, headers=AUTH)
+    assert resp.status_code == 200
+    results = resp.json()
+    assert len(results) == 1
+    assert results[0]["title"] == "commit a"
+
+
+def test_objects_for_date(client):
+    client.post(
+        "/objects",
+        json={"type": "standup", "object_date": "2026-05-05", "title": "standup"},
+        headers=AUTH,
+    )
+    client.post(
+        "/objects",
+        json={"type": "standup", "object_date": "2026-05-06", "title": "other day"},
+        headers=AUTH,
+    )
+    resp = client.get("/objects/date/2026-05-05", headers=AUTH)
+    assert resp.status_code == 200
+    results = resp.json()
+    assert len(results) == 1
+    assert results[0]["title"] == "standup"
+
+
+def test_update_object(client):
+    resp = client.post(
+        "/objects", json={"type": "recap", "object_date": "2026-05-05", "title": "orig"}, headers=AUTH
+    )
+    obj_id = resp.json()["id"]
+    resp = client.patch(f"/objects/{obj_id}", json={"title": "changed"}, headers=AUTH)
+    assert resp.status_code == 200
+    assert resp.json()["title"] == "changed"
+
+
+def test_update_missing_object_404(client):
+    resp = client.patch("/objects/nope", json={"title": "x"}, headers=AUTH)
+    assert resp.status_code == 404
+
+
+def test_delete_object(client):
+    resp = client.post(
+        "/objects", json={"type": "recap", "object_date": "2026-05-05", "title": "to-delete"}, headers=AUTH
+    )
+    obj_id = resp.json()["id"]
+    resp = client.delete(f"/objects/{obj_id}", headers=AUTH)
+    assert resp.status_code == 204
+    resp = client.get(f"/objects/{obj_id}", headers=AUTH)
+    assert resp.status_code == 404
+
+
+def test_delete_missing_object_404(client):
+    resp = client.delete("/objects/nope", headers=AUTH)
+    assert resp.status_code == 404