feat(api): add /api/stations router with CRUD and assignments

Implements the /api/stations FastAPI router (admin-only CRUD, recipe
assignment endpoints) and the public /by-code/{code}/recipes operator
endpoint. Registers the router in main.py and adds 8 integration tests.

server/tests/test_stations_api.py

@@ -0,0 +1,136 @@
+"""Integration tests for /api/stations endpoints."""
+import pytest
+from httpx import AsyncClient
+
+from tests.conftest import auth_headers, create_test_recipe
+
+
+async def test_list_stations_requires_auth(client: AsyncClient):
+    resp = await client.get("/api/stations")
+    assert resp.status_code == 401
+
+
+async def test_create_station_as_admin(client: AsyncClient, admin_user):
+    resp = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-API", "name": "Via API"},
+    )
+    assert resp.status_code == 201, resp.text
+    body = resp.json()
+    assert body["code"] == "ST-API"
+    assert body["active"] is True
+    assert body["id"] > 0
+
+
+async def test_create_station_non_admin_is_403(client: AsyncClient, maker_user):
+    resp = await client.post(
+        "/api/stations",
+        headers=auth_headers(maker_user),
+        json={"code": "ST-NO", "name": "No"},
+    )
+    assert resp.status_code == 403
+
+
+async def test_update_station(client: AsyncClient, admin_user):
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-UP", "name": "Old"},
+    )
+    station_id = created.json()["id"]
+    resp = await client.put(
+        f"/api/stations/{station_id}",
+        headers=auth_headers(admin_user),
+        json={"name": "New", "active": False},
+    )
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["name"] == "New"
+    assert body["active"] is False
+
+
+async def test_delete_station(client: AsyncClient, admin_user):
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-D", "name": "D"},
+    )
+    sid = created.json()["id"]
+    resp = await client.delete(
+        f"/api/stations/{sid}", headers=auth_headers(admin_user),
+    )
+    assert resp.status_code == 204
+    again = await client.get(
+        f"/api/stations/{sid}", headers=auth_headers(admin_user),
+    )
+    assert again.status_code == 404
+
+
+async def test_assign_and_unassign_recipe(
+    client: AsyncClient, admin_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, user_id=admin_user.id, code="REC-AS")
+    await db_session.commit()
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-ASSIGN", "name": "A"},
+    )
+    sid = created.json()["id"]
+    a = await client.post(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+        json={"recipe_id": recipe.id},
+    )
+    assert a.status_code == 201
+    r = await client.get(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+    )
+    assert r.status_code == 200
+    assert [rec["code"] for rec in r.json()] == ["REC-AS"]
+    u = await client.delete(
+        f"/api/stations/{sid}/recipes/{recipe.id}",
+        headers=auth_headers(admin_user),
+    )
+    assert u.status_code == 204
+    r2 = await client.get(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+    )
+    assert r2.json() == []
+
+
+async def test_list_recipes_by_station_code(
+    client: AsyncClient, admin_user, measurement_tec_user, db_session,
+):
+    recipe = await create_test_recipe(db_session, user_id=admin_user.id, code="REC-BC")
+    await db_session.commit()
+    created = await client.post(
+        "/api/stations",
+        headers=auth_headers(admin_user),
+        json={"code": "ST-BC", "name": "BC"},
+    )
+    sid = created.json()["id"]
+    await client.post(
+        f"/api/stations/{sid}/recipes",
+        headers=auth_headers(admin_user),
+        json={"recipe_id": recipe.id},
+    )
+    resp = await client.get(
+        "/api/stations/by-code/ST-BC/recipes",
+        headers=auth_headers(measurement_tec_user),
+    )
+    assert resp.status_code == 200
+    assert [r["code"] for r in resp.json()] == ["REC-BC"]
+
+
+async def test_list_recipes_by_unknown_code_404(
+    client: AsyncClient, measurement_tec_user,
+):
+    resp = await client.get(
+        "/api/stations/by-code/ST-DOES-NOT-EXIST/recipes",
+        headers=auth_headers(measurement_tec_user),
+    )
+    assert resp.status_code == 404