Add a JSON API to list and create social media snippets - #43

Closes #42.

Since #39 removed the ChatGPT step, nothing writes new social media snippets, and there is no API for them. This gives snippets the same Bearer-token JSON API that shares already have, so a client can store copy next to the article it belongs to. The table already has the columns it needs, so there is no migration.

What it adds

• GET /links/:link_id/social_media_snippets.json lists a link's snippets, oldest first. ?social_media_type=LinkedIn narrows it to one network.
• POST /links/:link_id/social_media_snippets.json creates one. It takes social_media_type and content. A JSON body works with or without the social_media_snippet wrapper key.
• Both endpoints are on the Bearer-token whitelist in ApplicationController, the same way shares is. A cookie-authenticated browser still gets a 401 on JSON.
• The link page no longer says its snippets "are created by Open AI". That stopped being true when Remove ChatGPT integration and stop generating social media snippets #39 removed the ChatGPT step, and snippets can now come from the API. The copy now reads "Suggested copy for posting this article. Pair each snippet with one of the shortened links above." It's a one-line change in links/show.html.erb, with a small view spec.

Responses follow what shares do: 201 with the snippet, 422 with { "errors": [...] }.

{ "id": 1, "link_id": 7, "social_media_type": "LinkedIn", "content": "...", "created_at": "..." }

What gets a 422

• a missing or unknown social_media_type (it has to be one of Bluesky, GoogleBusiness, LinkedIn, Mastodon, Twitter, spelled that way)
• blank content
• an exact duplicate: the same content for the same link and type, so a client can retry a request safely

Things I'd like a second opinion on

• No unique index for duplicates. The check is a model validation. The table already holds snippets from the old ChatGPT step, and a unique index could fail on duplicates in production. The catch is that two identical requests sent at the same instant could both pass. Is that fine?
• social_media_type is now required. The model allowed it to be blank before. Copy varies by network (length, style, tone), and the link page groups snippets by network, so one without a network doesn't make sense for new snippets.
• The new checks run on create only, like Share's UTM checks, so existing snippets, whatever their type, can still be edited.
• The list of types is the five from the issue. Share::UTM_SOURCES has more networks. Happy to align them if you'd rather.

Not in this PR

Updating or deleting snippets, and any HTML view (these endpoints are JSON only).

Testing

bundle exec rspec spec: 83 examples, 0 failures (54 before, 29 new). The request specs cover auth (no token, bad token, cookie only), validation, filtering, and JSON bodies, and a view spec covers the link page section. In the test environment Rails raises for an unknown link (RecordNotFound) or missing params (ParameterMissing) instead of rendering a 404 or 400, so those specs assert the exception.

🤖 Generated with Claude Code