feat: add absorb command — merge source entity into target

DB: Absorb() merges body (newline-separated), unions tags, demotes
crystallized sources, soft-deletes source. Rejects crystallized targets.

API: POST /api/entities/:id/absorb { source_id }

CLI: nib absorb <target> <source> with prefix ID resolution

Web: absorb button on fluid entities, 'a' keyboard shortcut,
source picker modal

internal/api/api_test.go

@@ -421,6 +421,92 @@ func TestCORS_ProdMode(t *testing.T) {
 	}
 }
 
+func TestAbsorbEntity_Success(t *testing.T) {
+	srv, _ := testServer(t)
+	target := createTestEntity(t, srv, "target body", []string{"ops"})
+	source := createTestEntity(t, srv, "source body", []string{"ops", "infra"})
+
+	resp := postJSON(srv, "/api/entities/"+target.ID+"/absorb", map[string]any{
+		"source_id": source.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("expected 200, got %d", resp.StatusCode)
+	}
+
+	var e EntityResponse
+	json.NewDecoder(resp.Body).Decode(&e)
+	if e.Body != "target body\nsource body" {
+		t.Errorf("merged body: %q", e.Body)
+	}
+	if len(e.Tags) != 2 {
+		t.Errorf("expected 2 tags, got %v", e.Tags)
+	}
+
+	// Source should be soft-deleted (not in default list)
+	listResp, _ := http.Get(srv.URL + "/api/entities")
+	var entities []EntityResponse
+	json.NewDecoder(listResp.Body).Decode(&entities)
+	listResp.Body.Close()
+	for _, ent := range entities {
+		if ent.ID == source.ID {
+			t.Error("source should be soft-deleted and hidden from default list")
+		}
+	}
+}
+
+func TestAbsorbEntity_TargetCrystallized(t *testing.T) {
+	srv, _ := testServer(t)
+	target := createTestEntity(t, srv, "target", nil)
+	source := createTestEntity(t, srv, "source", nil)
+
+	postJSON(srv, "/api/entities/"+target.ID+"/promote", map[string]any{
+		"card_type": "snippet",
+	}).Body.Close()
+
+	resp := postJSON(srv, "/api/entities/"+target.ID+"/absorb", map[string]any{
+		"source_id": source.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+
+	var errResp ErrorResponse
+	json.NewDecoder(resp.Body).Decode(&errResp)
+	if errResp.Error != "invalid_absorb" {
+		t.Errorf("error: %q", errResp.Error)
+	}
+}
+
+func TestAbsorbEntity_SameEntity(t *testing.T) {
+	srv, _ := testServer(t)
+	e := createTestEntity(t, srv, "self", nil)
+
+	resp := postJSON(srv, "/api/entities/"+e.ID+"/absorb", map[string]any{
+		"source_id": e.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+}
+
+func TestAbsorbEntity_MissingSourceID(t *testing.T) {
+	srv, _ := testServer(t)
+	e := createTestEntity(t, srv, "target", nil)
+
+	resp := postJSON(srv, "/api/entities/"+e.ID+"/absorb", map[string]any{})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+}
+
 func mustJSON(v any) []byte {
 	b, _ := json.Marshal(v)
 	return b

internal/api/entities.go

@@ -304,6 +304,50 @@ func demoteEntity(store *db.Store) http.HandlerFunc {
 	}
 }
 
+type AbsorbRequest struct {
+	SourceID string `json:"source_id"`
+}
+
+func absorbEntity(store *db.Store) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		id := chi.URLParam(r, "id")
+
+		var req AbsorbRequest
+		if !decodeJSON(w, r, &req) {
+			return
+		}
+
+		if req.SourceID == "" {
+			writeError(w, http.StatusBadRequest, "invalid_input", "source_id is required")
+			return
+		}
+		if req.SourceID == id {
+			writeError(w, http.StatusBadRequest, "invalid_input", "target and source must be different entities")
+			return
+		}
+
+		if err := store.Absorb(id, req.SourceID); err != nil {
+			if err == db.ErrNotFound {
+				writeError(w, http.StatusNotFound, "not_found", "target or source entity not found")
+				return
+			}
+			if err == db.ErrTargetCrystallized {
+				writeError(w, http.StatusBadRequest, "invalid_absorb", "target is crystallized — demote first")
+				return
+			}
+			writeError(w, http.StatusInternalServerError, "internal", err.Error())
+			return
+		}
+
+		e, err := store.Get(id)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, "internal", err.Error())
+			return
+		}
+		writeJSON(w, http.StatusOK, entityToResponse(e))
+	}
+}
+
 func useEntity(store *db.Store) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id := chi.URLParam(r, "id")

internal/api/router.go

@@ -31,6 +31,7 @@ func NewRouter(store *db.Store, devMode bool, webFS ...fs.FS) chi.Router {
 		r.Post("/entities/{id}/promote", promoteEntity(store))
 		r.Post("/entities/{id}/demote", demoteEntity(store))
 		r.Post("/entities/{id}/use", useEntity(store))
+		r.Post("/entities/{id}/absorb", absorbEntity(store))
 		r.Get("/tags", listTags(store))
 	})