[dancher00]

What this changes

Fixes #182.

After nesting A → B, nesting B → A currently succeeds. Longer cycles are accepted too. The service now returns 422 when the proposed child already contains the parent at any depth.

The check walks membership links after write authorization and the duplicate-link check. It tracks visited collections so it terminates on legacy cycles, and permits shared descendants when they do not introduce a cycle. The nesting rules are documented.

How it was tested

• Added seven API cases: two- and four-collection cycles, shared descendants, writes into a graph with an existing cycle, and JSON/JSON-LD reads of existing cyclic data.
• The three cycle-rejection cases failed before the fix on 37b9691; all seven now pass. Rejected links leave the existing chain intact.
• Python 3.14.6 and PostgreSQL 17: uv run --all-extras pytest — 887 passed, 11 end-to-end tests deselected by the default configuration.
• Ruff lint/format checks, pyright, alembic check, downgrade to base and upgrade to head passed.

Checklist

• uv run ruff check . and uv run ruff format --check . pass
• uv run pyright passes
• uv run --all-extras pytest passes
• Tests cover the change
• Documentation updated, if the change is user-visible
• Authorisation checks, if any, live in the service layer rather than the router