feat(api): add Git REST API for branch and commit operations (#270) (#282)

* feat(api): add Git REST API for branch and commit operations (#270)

Implement REST endpoints for git operations to unblock dependent tickets:
- POST /api/projects/{id}/git/branches - Create feature branch
- GET /api/projects/{id}/git/branches - List branches
- GET /api/projects/{id}/git/branches/{name} - Get branch details
- POST /api/projects/{id}/git/commit - Create commit
- GET /api/projects/{id}/git/commits - List commits
- GET /api/projects/{id}/git/status - Get working tree status

Add broadcast_branch_created WebSocket helper for real-time updates.
Include 46 comprehensive integration tests following TDD principles.

Unblocks: #271 (Git Commit UI), #272 (PR Creation API), #279 (Git Merge API)

* fix(api): address code review feedback for git API

- Security: Add branch name validation with regex pattern to prevent
  injection attacks via special git characters (~, ^, :, ?, *, etc.)
- Performance: Add single-query get_branch_by_name_and_issues() method
  replacing 3 sequential DB queries in get_branch endpoint
- Bug: Retrieve commit message from specific commit_hash instead of
  repo.head.commit which may have moved after creation
- Error handling: Replace broad Exception catches with specific types
  (git.BadName, git.InvalidGitRepositoryError, ValueError, KeyError)

* fix(api): validate issue exists and handle edge cases in git API

- Add 404 response when issue not found in create_branch endpoint
- Add VALID_BRANCH_STATUSES validation for status query parameter
- Use {branch_name:path} to support branch names with slashes
- Handle empty repos safely in get_git_status (no HEAD reference)
- Add test for issue-not-found scenario

Addresses code review feedback for PR #282.

* fix(api): correct staged_files tuple extraction and timestamp normalization

- Extract only path component from repo.index.entries.keys() tuples
  (keys are (path, stage) pairs, not plain strings)
- Use .astimezone(UTC) before formatting commit timestamps for proper
  UTC normalization

Addresses additional code review feedback for PR #282.

* fix(security): add path validation and handle branch creation race condition

Security fixes:
- Add validate_file_paths() to prevent directory traversal attacks
  in commit endpoint (rejects absolute paths, '..' segments, and
  paths that escape the workspace via symlink resolution)
- Handle branch creation race condition by returning 409 Conflict
  instead of 500 when concurrent requests create the same branch

Changes:
- Add os import for path validation
- Add validate_file_paths() function with commonpath check
- Call path validation before commit_task_changes()
- Update create_branch to return 409 for "already exists" errors
- Update test to expect 409 for duplicate branch creation
- Add 3 security tests for path validation (absolute, traversal, escape)

Test coverage: 50 tests passing

* style: remove extraneous f-string prefix (ruff F541)

---------

Co-authored-by: Test User <test@example.com>

Author: frankbria

codeframe/persistence/database.py

@@ -631,6 +631,10 @@ def count_branches_for_issue(self, *args, **kwargs):
         """Delegate to git_branches.count_branches_for_issue()."""
         return self.git_branches.count_branches_for_issue(*args, **kwargs)
 
+    def get_branch_by_name_and_issues(self, *args, **kwargs):
+        """Delegate to git_branches.get_branch_by_name_and_issues()."""
+        return self.git_branches.get_branch_by_name_and_issues(*args, **kwargs)
+
     def create_test_result(self, *args, **kwargs):
         """Delegate to test_results.create_test_result()."""
         return self.test_results.create_test_result(*args, **kwargs)

codeframe/persistence/repositories/git_repository.py

@@ -208,3 +208,33 @@ def count_branches_for_issue(self, issue_id: int) -> int:
         )
         return cursor.fetchone()[0]
 
+    def get_branch_by_name_and_issues(
+        self, branch_name: str, issue_ids: List[int]
+    ) -> Optional[Dict[str, Any]]:
+        """Get a branch by name that belongs to one of the given issues.
+
+        Single-query lookup for performance optimization.
+
+        Args:
+            branch_name: Git branch name to find
+            issue_ids: List of issue IDs the branch must belong to
+
+        Returns:
+            Branch dictionary or None if not found
+        """
+        if not issue_ids:
+            return None
+
+        cursor = self.conn.cursor()
+        placeholders = ",".join("?" * len(issue_ids))
+        cursor.execute(
+            f"""
+            SELECT * FROM git_branches
+            WHERE branch_name = ? AND issue_id IN ({placeholders})
+            LIMIT 1
+            """,
+            (branch_name, *issue_ids),
+        )
+        row = cursor.fetchone()
+        return dict(row) if row else None
+