fix(api): clear manual plan caps with explicit null

[cristim]

An explicit max_step_commitment: null now clears a manual plan cap. Omission preserves the cap, numeric values retain existing validation, and clearing is refused when the resulting plan has automatic purchasing enabled. Existing authorization and concurrent-update checks remain in place.

Related to #631. This fixes backend cap editing; the remaining scheduling and editor work stays tracked by #631.

Validation: focused race tests cover omission, null, numeric/invalid inputs, authorization denial, concurrent-update refusal and the unsupported Savings Plans rule. Routed PUT/GET tests use real PostgreSQL and migrations with simulated authentication. Independent verification reproduces the regression and guard-removal failure. Pinned lint, full backend build and normal hooks passed. Two independent source-review and cold-verification passes are clean at f8b359d43e68ce35b96259261a4f32b347bb7102 (tree a2ae092e457ac4414e3ba5341a8a0f9bcfdc39a9). Fresh-base native race runs passed in 24.954s (author) and 21.775s (independent verifier); focused authorization and Savings Plans race tests passed in 2.752s. Authentication is simulated; no cloud purchase was performed. CI must pass on this SHA before merge.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 5 billable files and costs up to $1.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 56 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 63 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: 211b4e6e-8755-4992-b99b-b7406454adf5

📥 Commits

Reviewing files that changed from the base of the PR and between c566035 and f8b359d.

📒 Files selected for processing: 5

• internal/api/handler_plans.go
• internal/api/handler_plans_concurrency_integration_test.go
• internal/api/handler_plans_sp_multistep_test.go
• internal/api/handler_plans_step_cap_test.go
• internal/api/openapi.yaml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Independent verification is clean at f8b359d43e68ce35b96259261a4f32b347bb7102, tree a2ae092e457ac4414e3ba5341a8a0f9bcfdc39a9, based on c5660356228e4451edeec818c32600ac36cd5e99.

The retained non-author source reviewer completed two adversarial passes over the full five-file diff. A separate cold verifier completed two passes and independently ran the routed PostgreSQL cap/Savings Plans suite with -race (21.775s). Checked omission versus explicit null, resulting automatic-mode refusal before write, invalid numeric/type input, unknown/case-insensitive JSON keys, permission and complete-account-scope refusal, preserved progress/dates, and real-store concurrent winner preservation through CAS. The Savings Plans regression still asserts its specific refusal reason.

Regression sensitivity: the actual pre-fix handler retained the cap after manual null and returned 200 for automatic null, while omission/numeric controls passed. Removing the automatic-null guard in a scratch overlay caused the automatic-null case to fail as intended. These parent/scratch probes were performed earlier; the relevant leaf and parent blobs were verified identical after the base transfer. The new-base real PostgreSQL runs were repeated. Authentication is simulated; no genuine-session or cloud-purchase evidence is claimed.

Normal hooks, pinned affected-package lint, full backend build and author race/native checks passed. CodeRabbit is optional under the project gate because exact-revision local scenario verification and thorough independent review cover this SHA; a green bot status alone is not counted as a review. Every actionable finding remains a merge blocker. CI and normal repository protections still apply.

[cristim]

CodeRabbit posted “Review limit reached” for this SHA and did not perform a review. No paid review was requested. The merge review gate uses the exact-SHA independent source/cold reviews and real PostgreSQL verification recorded above, as permitted by the project rule. CI and repository protections remain required.

[cristim]

Merged normally as 11901796190ed207156d882098a992f67a121bee. Its entire tree matches reviewed/tested f8b359d43e68ce35b96259261a4f32b347bb7102. All PR checks and post-merge workflows passed, including main CI and AWS deployment. The initial post-merge monitoring interruption was GitHub API quota, not a workflow failure; results were reconciled after its reset.

The real PostgreSQL routed regression and independent verification are recorded above. Authentication was simulated, and no production plan mutation or cloud purchase was performed. The merged shipping branch/worktree are cleaned up; original review refs remain preserved. Remaining scheduling and editor work stays tracked in #631.