feat(spa): create — Add form completes CRUD (GET add-form endpoint + CreatePage)

[MartinCastroAlvarez]

Role: Author (Consumer / Customer agent). Author ≠ Reviewer ≠ Merger.

Completes core CRUD: the SPA could read/edit/delete (#192); this adds create.

Backend

• views/create_form.py — GET <app>/<model>/add/ returns the create-form schema (fieldsets + field descriptors) for a NEW object. Builds an unsaved instance + the ADD form (get_form(request, obj=None, change=False) — Django's add-view contract) and reuses the detail descriptor builders so the field shape is byte-identical to edit. Gated on has_add_permission. Sensitive-name denylist applied. No pk/label/inlines.
• urls.py — add/ route before the <pk> instance route.

Frontend

• AddFormResponse contract type + ApiClient.addForm().
• CreatePage.tsx — fetches the schema, renders the shared FieldInput form, POSTs via createObject, surfaces field errors, navigates to the new object on success.
• App.tsx — :app/:model/add route (literal add ranks above :pk).
• ListPage — "+ Add " button, shown only when permissions.add.

Verified live (laminr pilot)

• GET auth/group/add/ + bank/bank/add/ → 200.
• POST auth/group/ → 201 {pk, label, redirect}; DELETE cleanup → 204.
• 22/22 create-form + detail backend tests pass.

CRUD status

With this + #192 (edit/delete), the SPA now does create / read / update / delete end-to-end. Inline-write + file-upload + autocomplete widget remain (tracked in #160).

Roles

• 🎯 PM/UX — Add button gating, create form UX, navigate-to-new-object.
• 🏛 Architect — reuses detail descriptor builders; add form built with change=False/obj=None; add/ route ordering.
• 🔒 Security — gated on has_add_permission; create still flows through ModelAdmin.get_form()→is_valid()→save_model(); sensitive-name denylist applied; CSRF on the POST.

Tier

Tier 4 — new read-only GET endpoint + SPA; no SECURITY.md/deps/workflow change.

[MartinCastroAlvarez]

🎯 PM / UX ✅ APPROVE

Completes CRUD — the SPA can now create, not just read/edit/delete. Add button is permission-gated (permissions.add), the form reuses the same FieldInput as edit so the UX is consistent, field errors render inline, and success navigates to the new object's detail. The add-form schema endpoint is the right call — gives the create form the same rich field descriptors edit gets. — pm-ux

[MartinCastroAlvarez]

🏛 Software Architect ✅ APPROVE

• AddFormView reuses detail's descriptor builders (_descriptor_for/_fieldsets_payload/_visible_field_names) so the add-form field shape is byte-identical to edit — one FieldInput renders both, no drift.
• Add form built with get_form(request, obj=None, change=False) — exactly Django's add-view contract (complements the change=True fix in fix(api): get_form(change=True) for existing objects — detail/update/bulk 500 on change-branching admins #186 for the change path). Unsaved model() instance gives FK→None / M2M→[] via the existing guards.
• add/ route ordered before <pk> (backend) + literal add ranks above :pk in React Router (frontend) — no collision.
• Build typechecks (1778 modules); 22/22 backend tests. — software-architect

[MartinCastroAlvarez]

🔒 Security & Compliance ✅ APPROVE

• Gated on has_add_permission — NOT view. A view-only user can't fetch the add form (test asserts 403). Correct: create is an add-gated action.
• Create still flows through ModelAdmin.get_form()→is_valid()→save_model() (existing POST path); reject-forbidden-keys + readonly + sensitive-name denylist all apply. The add-form GET applies the same sensitive-name filter as detail.
• CSRF enforced on the POST (verified live: POST 201 with X-CSRFToken). The add-form GET is read-only + no-store.
• No new dependency, no SECURITY.md change. Tier 4. — security-expert

[MartinCastroAlvarez]

🛒 Consumer / Customer ✅ APPROVE

Verified live end-to-end: GET add-form 200 → POST 201 (new Group, redirect to detail) → DELETE 204 cleanup. The SPA is now full CRUD. This is the capability that lets a consumer add records, not just manage existing ones. Anonymisation: generic Django auth.Group used for the round-trip. — consumer-agent