[bpepple]

Closes #651

Summary

Detail responses for arcs, characters, creators, imprints, issues, publishers, series, teams, and universes now include a read-only attribution list. Each entry gives the source name and the URL that the descriptive content was adapted from. API consumers that reuse desc can now credit the source, which some licenses require (Wikipedia's CC BY-SA, for example).

"attribution": [
  {"source": "Wikipedia", "url": "https://en.wikipedia.org/wiki/Spider-Man"},
  {"source": "Marvel", "url": "https://www.marvel.com/characters/spider-man-peter-parker"}
]

The list is empty when there's no attribution. List responses and create/update responses are unchanged. This is an additive, non-breaking change.

Changes

• Serializers: new AttributionSerializer (source and url), nested read-only on each detail serializer. source uses fixed English names, so the output doesn't change with the request's language and can be cached per object. It's declared in the schema as AttributionSourceEnum. Arc, Creator, and Publisher had no separate read serializer, so this adds ArcReadSerializer, CreatorReadSerializer, and PublisherReadSerializer and uses them for retrieve.
• Ordering: Attribution gets a stable default ordering (migration 0060), so the list order is deterministic.
• Cache invalidation: post_save/post_delete handlers on Attribution update the parent's modified field and bump its cache version. Adding, editing, or deleting an attribution (from the web form, an admin inline, or a merge) therefore invalidates the cached detail response and updates Last-Modified. A queryset delete bumps each parent once, and a cascade delete from the parent is skipped.
• Detail cache key version: detail cache keys now include DETAIL_CACHE_SCHEMA_VERSION (api/cache.py). Without it, responses cached before this deploy, which have no attribution field, would be served for up to DETAIL_CACHE_TTL (3 days). Bump the version whenever a detail response's shape changes.
• Edit views: the attribution create views (and IssueCreate) no longer save the parent twice. AttributionUpdateMixin now saves the parent inside the same transaction as the attribution formset, so a failed parent save can't leave attribution changes committed without it.
• Cleanup: removed the unused move_pub_to_imprint management command.
• Docs: api/README.md has a new Attribution section under Common Patterns, the field is listed for each of the nine resources, and there's a Version 1.12 changelog entry. That entry also covers the cover_date_range filter from Add cover_date_range filter to the issue API #628, which never got one.

Testing

New tests/comicsdb/test_api_attribution.py:

• For each of the nine resources: the list is empty by default, source names and URLs are returned, and it's absent from list responses.
• Every Attribution.Source has an API name, the schema names the enum, and an unknown stored code falls back to the raw value instead of erroring.
• Adding, editing, and deleting an attribution clears the cached detail response. If-Modified-Since returns 200 after a change, and the parent's modified and cache version are bumped. This also covers queryset deletes (each parent bumped once), cascade deletes, raw fixture loads, and parents without a modified field.
• Create views save the parent only once.

Also added: bumping DETAIL_CACHE_SCHEMA_VERSION turns a cached hit into a miss, and audit_response_cache still categorizes versioned detail keys by model.

Full suite passes. manage.py spectacular --validate reports no errors, and the Attribution component appears in the generated schema.

Deployment

The detail cache key version means old cached detail responses are never served again, but they stay in Redis until their TTL expires (up to 3 days). To free that memory right away, run this in manage.py shell after deploying:

from django.core.cache import cache

client = cache._cache.get_client()
deleted = 0
for key in client.scan_iter(match="*api:detail:*", count=1000):
    # Keep entries already written in the new format.
    if b":v2:" not in key:
        client.delete(key)
        deleted += 1
print(f"Deleted {deleted} old detail cache keys")

It only deletes old-format keys. The detail cache starts cold after the deploy either way, so expect a short rise in database load while it warms back up.

Known limitations

• Writing attributions through the API is out of scope and likely won't be added in a follow-up.
• An attribution's parent is never reassigned in the current code. Code that moves an attribution to a different parent must bump the old parent itself.