Support tag_ids on JSON card create/update

[robzolkos]

Summary

The cards JSON API already documents support for tag_ids, but CardsController was not wrapping or permitting that parameter. As a result, API clients could create or update cards successfully while tags were silently dropped from the request and the response came back with an empty tags array.

This change makes tag_ids work for JSON card create/update requests so the API behavior matches the docs and client expectations. It also validates that assigned tags belong to the card's account and returns standard unprocessable-entity responses for invalid tag assignments.

Ref: #2819

Changes

• permit tag_ids: [] in CardsController#card_params
• include tag_ids in wrap_parameters :card so flat JSON payloads work too
• validate that assigned tags belong to the card account
• return validation errors with 422 Unprocessable Entity for invalid JSON card create/update requests
• re-render the edit template with 422 Unprocessable Entity for invalid HTML card updates
• add regression coverage for:
  • nested JSON create with card: { tag_ids: [...] }
  • flat JSON create with tag_ids: [...]
  • nested JSON update with card: { tag_ids: [...] }
  • flat JSON update with tag_ids: [...]
  • clearing tags with tag_ids: []
  • preserving existing tags when tag_ids is omitted from an update
  • invalid HTML updates rendering the edit form again

Notes

• no docs update was needed because the API docs already list tag_ids for card create/update
• nonexistent tag IDs still return 404 Not Found
• foreign-account tag IDs are treated as invalid and return 422 Unprocessable Entity

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[rbarbosa]

Glad to see this coming to light! #2340

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[flavorjones]

This looks great, nice simplification from the earlier version. Two edge cases I'd like to see tests for — not because I think they're necessarily broken, but because the behavior should be fully specified:

1. Clearing tags with tag_ids: [] — the setter handles this path explicitly, so let's cover it.
2. Update without tag_ids preserves existing tags — confirms that omitting tag_ids from an update doesn't accidentally clear tags.