fix(datasets): route Inertia CUD through view endpoints + SM018 diagnostic

[antosubash]

Summary

• Bug: Inertia's client-side router.post/patch/delete in Datasets pages targeted /api/datasets/*, which returns plain JSON. Inertia rejects non-Inertia responses with "All Inertia requests must receive a valid Inertia response" — so Create, Edit, and Browse's delete button were all broken in the same way.
• Fix: Added view-layer CUD endpoints at /datasets/, /datasets/{id} (PATCH), /datasets/{id} (DELETE) that return RedirectResponse(303, constants.REDIRECT_BROWSE) — which Inertia follows correctly. Frontend now posts to these view routes. Extracted the upload body into a shared perform_upload() helper so both the REST API and the Inertia view endpoint reuse one implementation.
• Prevention: New SM018 module diagnostic that regex-scans pages/**/*.tsx for router.{post,patch,put,delete}('/api/...') across every module and warns at make doctor / dev boot. Catches this class of bug before it ships.

Changes

Datasets module

• endpoints/api.py — extracted perform_upload(...); the existing POST /api/datasets/ now delegates to it (unchanged behavior for REST clients).
• endpoints/views.py — new POST /, PATCH /{id}, DELETE /{id} that redirect to the browse page. All three use constants.REDIRECT_BROWSE (already defined for this purpose).
• pages/{Create,Edit,Browse}.tsx — target /datasets/* instead of /api/datasets/*. No props / UI changes.
• tests/test_datasets.py — new TestDatasetsViews class with 6 tests: 303 redirect + row-landed on create, unknown-kind rejection, update round-trip, delete removes row, and 404 paths for update/delete.

Framework diagnostic (SM018)

• diagnostics/_inertia_api.py (new) — pre-compiled regex that flags router.{post,patch,put,delete}('/api/...') in TSX with file:line, suggests using a view endpoint that redirects, and skips router.get (non-mutation) and non-string URLs.
• diagnostics/_module.py — invokes the check per-module alongside the existing orphan-page/phantom-render checks.
• tests/test_module_diagnostics.py — TestSM018InertiaApiCalls with 5 tests: fires on the anti-pattern for all four verbs, silent on view-path / router.get / no-pages-dir.
• CLAUDE.md — documented SM018 in the diagnostic-codes table.

Test plan

• uv run pytest modules/datasets/tests/ — 45 passed
• uv run pytest framework/core/tests/test_module_diagnostics.py — 9 passed (4 existing SM017 + 5 new SM018)
• make doctor — 0 errors, 0 SM018 warnings across all modules after the frontend fix
• Manually confirmed SM018 fires by temporarily reintroducing router.post('/api/...') in a tmp page
• Ruff + ruff format clean on all touched files
• Ty type-check clean on modules/datasets/datasets/

Reviewer notes

• The REST API endpoints under /api/datasets/* are untouched and still return JSON for external consumers (tests covering them still pass).
• perform_upload takes 9 positional args — this is deliberate. FastAPI Depends can't be applied inside a plain helper, and packaging the args into a dataclass would just shift boilerplate without reducing coupling.
• delete_view mirrors the pre-existing double-fetch pattern in delete_dataset (get-by-id then service.delete which re-fetches internally). Fixing that properly requires a service-signature change that affects both routes; left as a separate concern.
• SM018 uses text regex rather than an AST walk — TSX isn't parseable by Python's ast module, and the pattern is unambiguous enough that string matching catches it reliably. Same tradeoff as the existing _js_workspace.py check.