feat(sources): admin page to add and remove git sources (TODO.md L4)

tests/integration/test_import_docs_git.py

@@ -4,9 +4,14 @@ Drives ``scripts.import_docs`` end to end with a fake ``clone_or_pull`` (no
 real git, no network) and a recording fake ``import_sources`` (no real
 DB), covering:
 
-- ``BOR_GIT_SOURCES`` set → each URL is cloned/pulled into
-  ``BOR_SOURCES_DIR/<repo-name>/`` and exactly those dirs are imported.
-- ``--source`` still wins over ``BOR_GIT_SOURCES`` (no git at all).
+- Effective git sources set (phase 35: the shared resolver — stubbed
+  here, keeping this file's no-real-DB style) → each URL is cloned/pulled
+  into ``BOR_SOURCES_DIR/<repo-name>/`` and exactly those dirs are
+  imported.
+- DB rows win over ``BOR_GIT_SOURCES`` (the resolver's ``db`` origin —
+  the env list is ignored).
+- ``--source`` still wins over git sources (no git at all, no resolver
+  call).
 - No git sources + no ``--source`` → the legacy ``DEFAULT_SOURCES``.
 - A failing git sync → exit code 1, an error naming the failing repo on
   stderr, and **zero** import attempts.
@@ -91,6 +96,13 @@ def test_resolve_sources_git_urls_cloned_into_sources_dir(
 ) -> None:
     calls, fake = _fake_clone_factory()
     monkeypatch.setattr(import_docs, "clone_or_pull", fake)
+    # Phase 35: resolution goes through the shared resolver (stubbed —
+    # this file keeps its no-real-DB style); the URLs are the env list.
+    monkeypatch.setattr(
+        import_docs,
+        "effective_git_sources",
+        lambda db: (["https://host/a/homelab.git", "git@host:user/deploy.git"], "env"),
+    )
     settings = _settings(
         git_sources="https://host/a/homelab.git, git@host:user/deploy.git ,",
         sources_dir=str(tmp_path / "bor"),
@@ -119,7 +131,34 @@ def test_resolve_sources_cli_source_wins(
     assert calls == []  # git is never touched when --source is given
 
 
-def test_resolve_sources_defaults_when_nothing_configured() -> None:
+def test_resolve_sources_db_rows_win_over_env(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Phase 35: the resolver's ``db`` origin (table has rows) — the
+    ``BOR_GIT_SOURCES`` list must be ignored; only the DB repo is cloned."""
+    calls, fake = _fake_clone_factory()
+    monkeypatch.setattr(import_docs, "clone_or_pull", fake)
+    monkeypatch.setattr(
+        import_docs,
+        "effective_git_sources",
+        lambda db: (["https://db.example/only.git"], "db"),
+    )
+    settings = _settings(
+        git_sources="https://env.example/ignored.git",
+        sources_dir=str(tmp_path / "bor"),
+    )
+
+    sources = import_docs._resolve_sources(None, settings)
+
+    assert sources == [tmp_path / "bor" / "only"]
+    assert calls == [("https://db.example/only.git", tmp_path / "bor" / "only")]
+
+
+def test_resolve_sources_defaults_when_nothing_configured(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # Both origins empty (the resolver's ``([], "env")``) → legacy dirs.
+    monkeypatch.setattr(import_docs, "effective_git_sources", lambda db: ([], "env"))
     sources = import_docs._resolve_sources(None, _settings())
     assert sources == [p.expanduser() for p in import_docs.DEFAULT_SOURCES]
 
@@ -137,6 +176,11 @@ def test_main_git_sources_clone_then_import(
         sources_dir=str(tmp_path / "bor"),
     )
     monkeypatch.setattr(import_docs, "get_settings", lambda: settings)
+    monkeypatch.setattr(
+        import_docs,
+        "effective_git_sources",
+        lambda db: (["https://host/a/homelab.git", "https://host/a/deploy.git"], "env"),
+    )
     calls, fake = _fake_clone_factory()
     monkeypatch.setattr(import_docs, "clone_or_pull", fake)
     fake_import = FakeImportSources()
@@ -191,6 +235,9 @@ def test_main_git_failure_aborts_before_import(
         sources_dir=str(tmp_path / "bor"),
     )
     monkeypatch.setattr(import_docs, "get_settings", lambda: settings)
+    monkeypatch.setattr(
+        import_docs, "effective_git_sources", lambda db: (["https://host/a/bad.git"], "env")
+    )
 
     def failing_clone(url: str, dest: Path | str) -> Path:
         raise GitSyncError(