test(09-05): add failing tests for writable fill and validate

- Create and update must Fill then Validate and return D-10 422 field errors
- Schema bindings exclude protected, cased, nested, and unknown keys
- Missing Fill or Validate capability fails closed with controller context

cabana/crud.go

@@ -0,0 +1,71 @@
+package cabana
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	"gorm.io/gorm"
+)
+
+// CRUDService runs schema-projected record and bulk operations.
+type CRUDService struct {
+	DB *gorm.DB
+}
+
+// RecordInput is a decoded JSON object. Keys are untrusted.
+type RecordInput struct {
+	Body map[string]any
+}
+
+// BulkDeleteInput is the bulk-delete body.
+type BulkDeleteInput struct {
+	IDs []any `json:"ids"`
+}
+
+// BulkResult is the deleted-count payload.
+type BulkResult struct {
+	Deleted int `json:"deleted"`
+}
+
+// ValidationError is a D-10 validation_failed failure.
+type ValidationError struct {
+	Details map[string]any
+}
+
+func (e *ValidationError) Error() string { return "validation_failed" }
+
+// CapabilityError is a fail-closed Fill/Validate failure with controller context.
+type CapabilityError struct {
+	ControllerID string
+}
+
+func (e *CapabilityError) Error() string {
+	return "cabana: controller " + e.ControllerID + ": missing Fill/Validate capability"
+}
+
+var errCRUDNotReady = errors.New("cabana: crud is not implemented")
+
+// ProjectWritableFields copies only activation-bound writable keys.
+func ProjectWritableFields(cc *CompiledController, body map[string]any) map[string]any {
+	return nil
+}
+
+// BindWritableFields records schema field names onto model fill keys.
+func BindWritableFields(cc *CompiledController) error {
+	return errCRUDNotReady
+}
+
+// Create persists a projected record after Fill and Validate.
+func (s CRUDService) Create(ctx context.Context, cc *CompiledController, in RecordInput) (map[string]any, error) {
+	return nil, errCRUDNotReady
+}
+
+// Update persists a projected change after Fill and Validate.
+func (s CRUDService) Update(ctx context.Context, cc *CompiledController, id any, in RecordInput) (map[string]any, error) {
+	return nil, errCRUDNotReady
+}
+
+func writeCRUDError(w http.ResponseWriter, err error) {
+	WriteError(w, http.StatusInternalServerError, "error", msgServerError)
+}