Address PR #11 review comments: preserve metadata, add 404 checks, improve concurrency safety and accessibility

[Copilot]

Fixes issues identified in PR #11 review covering metadata preservation, missing error responses, concurrency risks, accessibility gaps, and inconsistent API usage.

Backend

Agent Card deserialization – Legacy capabilities stored in metadata before unmarshaling were being lost when the struct was overwritten. Now preserved in temporary variable and re-attached:

var legacyCapabilitiesData any
// ... detect and store legacy data
*a = AgentCard(*aux)
if legacyCapabilitiesData != nil {
    a.Metadata["legacyCapabilities"] = legacyCapabilitiesData
}

Standup handlers – Update/delete returned 200 even when resource didn't exist. Added RowsAffected() checks for 404 responses. Optimized update to use RETURNING clause (single query vs two).

Migration concurrency – Multiple containers could execute same migration simultaneously. Added PostgreSQL advisory locks:

pg_try_advisory_lock() → pg_advisory_lock() if busy → run migrations → pg_advisory_unlock()

Migration file filtering – Bootstrap scripts were being executed as migrations. Changed from hardcoded digit checks to regex ^\d pattern.

Frontend

Async state management – ReassignModal reset isSubmitting immediately after emit, before parent's async work completed. Added callback pattern for proper state coordination.

Accessibility – Added aria-label attributes to icon-only buttons (edit/delete standups, modal close).

Error handling – Refresh in Standups view didn't clear previous errors. Now clears error.value on retry.

Date formatting – new Date(dateString) caused timezone shifts for DATE columns. Parse as date-only to avoid offset:

const [year, month, day] = dateOnly.split('-').map(Number)
const date = new Date(year, month - 1, day) // Local timezone, no shift

API consistency – Task reassignment used raw fetch() instead of shared API service (bypassed configurable base URL). Added api.reassignTask() method.

Security

Credential leakage – PowerShell bootstrap script logged full DATABASE_URL including password. Added regex masking: postgres://user:****@host:port/db.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.