feat(rag): global tuning manager — /tuning.html + PUT /api/steering/{id}: create, edit, list, delete steering notes without a chat

app/api/steering.py

@@ -5,10 +5,13 @@ Admin-only CRUD under ``/api/steering`` (phase 16, A10 revised): notes
 are owner instructions stored in Postgres (``steering_notes``) and read
 into the system prompt of **every** chat turn as the ``<tuning>`` section
 (see :func:`app.rag.prompts.build_steering_section` and
-:func:`app.api.chat.chat`). The whole router sits behind
-:func:`app.core.auth.require_admin` — anonymous callers get 403 on every
-steering route (the chat turn itself reads the table in-process and
-stays public).
+:func:`app.api.chat.chat`). Routes: ``GET`` (list, newest first),
+``POST`` (create), ``PUT /{note_id}`` (update — phase 27; full
+replacement of ``note``, ``created_at`` preserved), ``DELETE /{note_id}``.
+The whole router sits behind :func:`app.core.auth.require_admin` —
+anonymous callers get 403 on every steering route (the chat turn itself
+reads the table in-process and stays public); the PUT route adds no auth
+surface of its own, it reuses that router-level dependency.
 """
 from __future__ import annotations
 
@@ -22,7 +25,7 @@ from app.core.auth import require_admin
 from app.db import get_db
 from app.models import SteeringNote
 from app.schemas import SteeringNote as SteeringNoteOut
-from app.schemas import SteeringNoteIn, SteeringNoteList
+from app.schemas import SteeringNoteIn, SteeringNoteList, SteeringNoteUpdate
 
 router = APIRouter(
     prefix="/steering",
@@ -68,6 +71,28 @@ def create_steering_note(
     return SteeringNoteOut(id=row.id, note=row.note, created_at=row.created_at)
 
 
+@router.put("/{note_id}", response_model=SteeringNoteOut)
+def update_steering_note(
+    note_id: uuid.UUID,
+    payload: SteeringNoteUpdate,
+    db: Session = Depends(get_db),  # noqa: B008
+) -> SteeringNoteOut:
+    """Replace a note's text in place (phase 27); 404 when the id is unknown.
+
+    ``created_at`` is preserved — editing a note does not redate it, so the
+    list order (newest first) and the ``<tuning>`` numbering (oldest first)
+    stay stable across edits. The router-level ``require_admin`` dependency
+    gates this route like every other steering route.
+    """
+    row = db.get(SteeringNote, note_id)
+    if row is None:
+        raise HTTPException(status_code=404, detail="steering note not found")
+    row.note = payload.note.strip()
+    db.commit()
+    db.refresh(row)
+    return SteeringNoteOut(id=row.id, note=row.note, created_at=row.created_at)
+
+
 @router.delete("/{note_id}", status_code=204)
 def delete_steering_note(
     note_id: uuid.UUID,