fix: an unknown redirect status, match or query is refused, not defaulted (WR-17)

The API, MCP, batches and the CSV import copied any value and Normalize
replaced it with the default, answering 201 for a 307 saved as a 301.
RedirectFields.Problems refuses values outside {301, 302, 410}, {exact,
pattern, regex} and {ignore, pass} with value_invalid; the import marks
such rows refused.

classes/batch.go

@@ -49,6 +49,36 @@ type RedirectFields struct {
 	Note          *string `json:"note,omitempty"`
 }
 
+// Problems refuses a status, match or query option outside the allowed
+// values (WR-17), so a caller learns its request was not taken rather than
+// getting a default in its place; an empty match or query is the default.
+func (f RedirectFields) Problems() map[string][]models.Problem {
+	out := map[string][]models.Problem{}
+	invalid := []models.Problem{{Key: "golem15.seo::lang.api.value_invalid"}}
+	if f.Status != nil {
+		switch models.RedirectStatus(*f.Status) {
+		case models.Status301, models.Status302, models.Status410:
+		default:
+			out["status"] = invalid
+		}
+	}
+	if f.Match != nil {
+		switch strings.TrimSpace(*f.Match) {
+		case "", models.RedirectExact, models.RedirectPattern, models.RedirectRegex:
+		default:
+			out["match"] = invalid
+		}
+	}
+	if f.Query != nil {
+		switch strings.TrimSpace(*f.Query) {
+		case "", models.QueryIgnore, models.QueryPass:
+		default:
+			out["query"] = invalid
+		}
+	}
+	return out
+}
+
 // Apply writes the fields that are set onto r.
 func (f RedirectFields) Apply(r *models.Redirect) {
 	if f.Source != nil {
@@ -380,6 +410,9 @@ func (s *Service) applyChange(ctx context.Context, tx *gorm.DB, index int, ch Ba
 			}
 		}
 		if ch.Redirect != nil {
+			if problems := ch.Redirect.Problems(); len(problems) > 0 {
+				return &ProblemsError{Problems: problems}
+			}
 			ch.Redirect.Apply(&r)
 		}
 		check, err := s.SaveRedirect(ctx, tx, &r)