[gedaiu]

Related: #1243 (a write token sets up a base and a statements source), #1271 (searching those documents one source at a time), #1268 (an api push keeps its external_id).

What happened

A write token can set up a base and a statements source (0014 decision 6), but a backend that also mirrors code and docs pushes those as plain documents through an api source, and creating one took a session.

What changed

sources_routes::create lets a token create both push-only kinds, statements and api: the server fetches nothing for either, and the client pushes with the source key from ingest_token. url, rss and custom, which the server polls (and custom with a stored credential), still need a session; the refusal message names both allowed kinds. has_push_token(&Source) becomes is_push_kind(&str) so the guard and the three existing callers share one list of push-only kinds.

0014 decision 6 and access-and-audit.md say "a statements or api source", with one dated revision.

Tests

a_write_token_creates_an_api_source_and_reads_its_push_key (api::token_setup_tests): a write token creates an api source and reads its push key. It fails without the change with 403 token_source_kind; the existing refusal for url stays.

Run in rust:1-slim-bookworm against Postgres with UTOPIA_TEST_REQUIRE_DB=1: cargo fmt --all --check and cargo clippy --workspace --all-targets -- -D warnings clean; cargo test -p utopia-server token_setup 5 passed.

[WaylandYang]

Thank you. On #1244 I said a token could create api sources if you needed them, and mirroring code and docs as plain documents is a good reason. api really is push-only: sync_source treats it as a passive container and fetches nothing even if an interval is set, and the push carries its content inline, so there is no address for the server to call and no stored credential. The coded 403 still refuses every other kind, sessions are unchanged, and is_push_kind keeps the guard and the three push-key routes on one list. One small thing for a later touch: the reflowed line in decision 6 runs past 100 columns. Merging.