temps-add-handler

Add an HTTP handler

Handlers are the thin HTTP layer: authenticate, authorise, call one service, audit the write, map the result. Everything else lives in the service.

Reference crate: crates/temps-flags (small, complete, follows every rule):

Read first: AGENTS.md (Errors, Architecture), REVIEW.md → "Authorization and scope" and "Secrets must not reach logs".

1. Service first

If the behaviour does not exist in a service yet, add it there: a method on the crate's service struct returning Result<T, DomainError> (a thiserror enum whose variants carry the IDs involved). No anyhow in services. The handler never imports sea_orm or touches an entity; scripts/rule_drift.py counts handler_db_access for any use sea_orm / Entity::find in handlers/ or handlers.rs.

2. DTOs

In the crate's handlers/types.rs (or next to the handler):

• Request and response structs derive Serialize/Deserialize and utoipa::ToSchema; query structs derive utoipa::IntoParams.
• Never return Json<serde_json::Value>; always a typed struct.
• Convert models to responses with From/a constructor; do not serialise entities directly.
• Dates are DateTime<Utc> (ISO 8601 with Z).
• Secrets: a stored key, token or password is never returned. Return a flag such as has_secret: bool (crates/temps-webhooks/src/handlers.rs) or ***. The only exception is a credential minted by this request (a new API key, a reset password): returned once, with Cache-Control: no-store, never logged or audited; see reset_user_password in crates/temps-auth/src/handlers.rs.
• Lists are paginated: page (default 1), page_size (default 20, max 100), sorted created_at DESC unless the domain has a better natural order. Clamp in one shared helper, as normalize_pagination in the flags service does, so the handler's total_pages matches what the service served.