feat: agent coordination system (workflows, locks, components, messages)

Adds /api/coord/* endpoints for real-time cross-session coordination:
- coord_workflows: named units of work per project
- coord_work_items: tasks within workflows with dependency chains
- coord_session_locks: exclusive resource locks with auto-expiry (TTL)
- coord_component_states: live component state per project (upsert)
- coord_messages: cross-session messaging and broadcasts
- /api/coord/status: cross-project snapshot endpoint

Replaces PROJECT_STATE.md as the coordination layer for Claude sessions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/routers/coord_locks.py

@@ -0,0 +1,81 @@
+"""Coordination session locks router."""
+
+from uuid import UUID
+
+from fastapi import APIRouter, Depends, Query, status
+from sqlalchemy.orm import Session
+
+from api.database import get_db
+from api.middleware.auth import get_current_user
+from api.schemas.coord_session_lock import CoordSessionLockCreate, CoordSessionLockResponse
+from api.services import coord_lock_service
+
+router = APIRouter()
+
+
+@router.get("", response_model=dict, status_code=status.HTTP_200_OK)
+def list_active_locks(
+    project_key: str | None = Query(default=None),
+    session_id: str | None = Query(default=None),
+    skip: int = Query(default=0, ge=0),
+    limit: int = Query(default=100, ge=1, le=1000),
+    db: Session = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """List currently active locks with optional filters."""
+    locks, total = coord_lock_service.get_active_locks(
+        db, project_key=project_key, session_id=session_id, skip=skip, limit=limit
+    )
+    return {
+        "total": total,
+        "skip": skip,
+        "limit": limit,
+        "locks": [CoordSessionLockResponse.model_validate(l) for l in locks],
+    }
+
+
+@router.get("/check", response_model=dict, status_code=status.HTTP_200_OK)
+def check_resource_locked(
+    project_key: str = Query(...),
+    resource: str = Query(...),
+    db: Session = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Check whether a resource is currently locked."""
+    lock = coord_lock_service.check_resource_locked(db, project_key, resource)
+    if lock:
+        return {"locked": True, "lock": CoordSessionLockResponse.model_validate(lock)}
+    return {"locked": False}
+
+
+@router.post("", response_model=CoordSessionLockResponse, status_code=status.HTTP_201_CREATED)
+def claim_lock(
+    data: CoordSessionLockCreate,
+    db: Session = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Claim a resource lock for a session."""
+    lock = coord_lock_service.claim_lock(db, data)
+    return CoordSessionLockResponse.model_validate(lock)
+
+
+@router.delete("", response_model=dict, status_code=status.HTTP_200_OK)
+def release_all_session_locks(
+    session_id: str = Query(..., description="Release all active locks held by this session"),
+    db: Session = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Release all active locks for a session (call on session end)."""
+    return coord_lock_service.release_all_session_locks(db, session_id)
+
+
+@router.delete("/{lock_id}", response_model=CoordSessionLockResponse, status_code=status.HTTP_200_OK)
+def release_lock(
+    lock_id: UUID,
+    session_id: str = Query(..., description="Must match the session that claimed the lock"),
+    db: Session = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Release a specific lock by ID."""
+    lock = coord_lock_service.release_lock(db, lock_id, session_id)
+    return CoordSessionLockResponse.model_validate(lock)