feat(sources): admin page to add and remove git sources (TODO.md L4)

app/schemas.py

@@ -154,3 +154,46 @@ class SteeringNoteList(BaseModel):
     """``GET /api/steering`` response: all notes, newest first."""
 
     notes: list[SteeringNote]
+
+
+class GitSourceIn(BaseModel):
+    """``POST /api/git-sources`` body: one repo URL (phase 35, task 02).
+
+    Mirrors :class:`SteeringNoteIn` — the URL is trimmed *before* the
+    length constraints run, so a whitespace-only body is a 422 and a URL
+    with surrounding spaces is stored clean. Shape validation
+    (``https://``, ``ssh://``, ``git@``) happens in the API layer so the
+    422 detail can be one generic string that never echoes the input.
+    """
+
+    url: str = Field(min_length=1, max_length=500)
+
+    @field_validator("url", mode="before")
+    @classmethod
+    def _trim_url(cls, v: object) -> object:
+        return v.strip() if isinstance(v, str) else v
+
+
+class GitSourceOut(BaseModel):
+    """One git source as returned by the API (phase 35, task 02).
+
+    ``id`` / ``added_at`` are nullable: env-fallback rows (table empty →
+    the list comes from ``BOR_GIT_SOURCES``) carry neither, only a URL.
+    """
+
+    id: uuid.UUID | None
+    url: str
+    added_at: datetime | None
+
+
+class GitSourceList(BaseModel):
+    """``GET /api/git-sources`` response (phase 35, task 02).
+
+    ``from_env`` is True only when the ``git_sources`` table is empty and
+    the list comes from ``BOR_GIT_SOURCES`` (the phase's locked fallback);
+    once the table has rows the env var is ignored and ``from_env`` is
+    False — the UI is the source of truth.
+    """
+
+    sources: list[GitSourceOut]
+    from_env: bool