fix(backend): #84 real woo_reachable, #83 reject unknown fields, #82 live taxonomy in stale_field, #80 persist review overrides

#84: /api/health woo_reachable is now a real check (GET /wp-json/ with a
3s timeout) instead of a hardcoded False stub. Version bumped to 0.5.0-m3-s1.

#83: POST /slabs rejects unknown (non-ALLOWED_FIELDS) keys with a 400
'unknown fields' error, instead of silently dropping them. The INSERT
binding count is now provably correct (no more assert needed).

#82: stale_field 422 error now returns the LIVE taxonomy ids
(SELECT id FROM table) as current_options, plus the field name and
submitted value, instead of echoing the submitted value back.

#80: regular review (no lock) persists owner overrides (price/sku/title/
short_description) from the payload to the DB via an UPDATE, so the
review endpoint is self-contained. server_rev is incremented on persist.

Tests: +3 (test_create_rejects_unknown_fields,
test_update_stale_field_returns_live_options,
test_review_persists_owner_overrides). 87/87 passing.

backend/tests/test_review.py

@@ -222,3 +222,31 @@ def test_lock_owner_prose_wins(env):
     assert body["short_description"] == "Owner-authored short description."
     got = client.get("/api/v1/slabs/s1").json()
     assert got["title"] == "My Handcrafted Walnut Slab"
+
+
+def test_review_persists_owner_overrides(env):
+    """#80: regular review (no lock) persists price/sku/title/short_description
+    overrides from the payload to the DB, so the client doesn't need a separate
+    PUT for each override."""
+    client, conn = env
+    conn.execute("INSERT INTO slabs(id,sku,length_in,thickness_in,sqft,bdft,width_min_in,width_max_in,width_avg_in,species_id,wood_category_ids,figure_term_ids,price,price_source,title,short_description,description,content_source,status,server_rev,client_rev,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
+                 ("s1","SLAB-01",114.0,1.75,30.0,18.4,18.0,24.3,24.3,1,json.dumps([2]),json.dumps([1]),None,None,None,None,"A slab","manual","calibrated",1,1,"t","t"))
+    conn.commit()
+    # Review with owner overrides for price + sku + title + short_description.
+    r = client.post("/api/v1/slabs/s1/review", json={
+        "price": 250.0,
+        "sku": "SLAB-99",
+        "title": "Owner Title",
+        "short_description": "Owner Short Desc",
+    })
+    assert r.status_code == 200
+    body = r.json()
+    assert body["price"] == 250.0
+    # The overrides are persisted: GET reflects them.
+    got = client.get("/api/v1/slabs/s1").json()
+    assert got["price"] == 250.0
+    assert got["sku"] == "SLAB-99"
+    assert got["title"] == "Owner Title"
+    assert got["short_description"] == "Owner Short Desc"
+    # server_rev was incremented (the UPDATE fired).
+    assert got["server_rev"] == 2