Remove three kinds of duplication in the backend

Stage 2, items 1, 4, and 5 of `plan/17-refactor.md`.

**One path resolver in `worldstate`.** `apply_delta` and `apply_override` routed
`flags.<name>`, `milestones.<id>`, `world.<stat>`, `player.<stat>`, and
`npc.<id>.<stat>` with parallel code, about 100 lines each. `_resolve` now says
what a path points at and returns either a target or the rejection to report.
Each function keeps its own write rule, because the rules genuinely differ: an
override sets a number rather than adding to it, ignores `cooldown`,
`max_delta_per_turn`, and the rule that a counter only counts up, and can un-set
a milestone.

A differential check ran both implementations over 3960 payloads: twenty paths,
fourteen values, three starting states, plus every three-path combination. The
results are identical except that 674 rejections from `apply_override` now carry
a `fix` string. `apply_delta` already worded those, and the world-state editor
renders them, so an override that names an unknown flag now explains itself the
way a delta does.

**`sse`, `SSE_HEADERS`, and `turn_error` move to `app/sse.py`.** Two routers
stream, and `chat.py` had to import from `routers.adventures` to reach them.

**`get_adventure_or_404` becomes the `current_adventure` dependency.** All 32
handlers repeated the call as their first statement. The ownership check now
reads in the signature and runs before the body. FastAPI caches a dependency for
one request, so the handler's `db` is the session the adventure came from.

The generated OpenAPI document is byte-identical except on `rename_branch`,
where `branch_id` is now listed before `adventure_id`, because that handler no
longer names `adventure_id` itself. Parameter order in the document is
cosmetic.

Six tests in `test_state_revert.py` call `undo_turn` and `retry_action`
directly rather than over HTTP. They pass the adventure they already hold
instead of an id.

549 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Dix4oGV3njgWRdu7P9t6r

backend/app/routers/adventures/turns.py

@@ -6,7 +6,6 @@ lock guards one set only while one module owns it. And a test that replaces
 `OpenAICompatibleProvider`, `generate_turn`, or `check_demo_cap` patches this
 module, which every caller reads through.
 """
-import json
 import threading
 
 from fastapi import Depends, HTTPException, Request
@@ -20,9 +19,10 @@ from ...context import build_context, cursors
 from ...database import get_db
 from ...providers import OpenAICompatibleProvider, PromptParts, ProviderError
 from ...scripting import ScriptPipeline
+from ...sse import SSE_HEADERS, sse, turn_error
 from ..settings import get_settings
 
-from .deps import CurrentUser, get_adventure_or_404, router
+from .deps import CurrentUser, current_adventure, router
 from .nodes import _move_to_after, next_depth, next_index
 from .paging import annotate_takes
 
@@ -98,27 +98,6 @@ def format_player_input(action_type: str, text: str) -> str:
     return text  # The "story" type is appended as raw text.
 
 
-def sse(obj: dict) -> str:
-    return f"data: {json.dumps(obj)}\n\n"
-
-
-def turn_error(detail: str, **extra) -> str:
-    """Returns an SSE error for a turn that could not be produced, and counts it.
-
-    A failed turn is still an HTTP 200 response, so the middleware's status-code
-    tally cannot see it. This metric exists so that a demo whose model refuses
-    every request does not report as healthy.
-    """
-    analytics.record(analytics.M_EVENT, analytics.EV_TURN_ERROR)
-    return sse({"type": "error", "detail": detail, **extra})
-
-
-# `no-cache` stops an intermediary from caching the stream. `X-Accel-Buffering`
-# makes nginx-style reverse proxies, which hosted deploys use, flush each event
-# immediately rather than buffer it.
-SSE_HEADERS = {"Cache-Control": "no-cache", "X-Accel-Buffering": "no"}
-
-
 def action_json(action: models.Action, db: Session | None = None) -> dict:
     """Serializes one action for the wire.
 
@@ -425,8 +404,8 @@ def create_action(
     request: Request,
     db: Session = Depends(get_db),
     user: models.User = CurrentUser,
+    adventure: models.Adventure = Depends(current_adventure),
 ):
-    adventure = get_adventure_or_404(adventure_id, db, user)
     limits.rate_limit("turn", request, user)
     limits.check_row_cap("actions", db, user, adventure=adventure)
     check_demo_cap(db, user)