feat: add absorb command — merge source entity into target

DB: Absorb() merges body (newline-separated), unions tags, demotes
crystallized sources, soft-deletes source. Rejects crystallized targets.

API: POST /api/entities/:id/absorb { source_id }

CLI: nib absorb <target> <source> with prefix ID resolution

Web: absorb button on fluid entities, 'a' keyboard shortcut,
source picker modal

internal/api/api_test.go

@@ -421,6 +421,92 @@ func TestCORS_ProdMode(t *testing.T) {
 	}
 }
 
+func TestAbsorbEntity_Success(t *testing.T) {
+	srv, _ := testServer(t)
+	target := createTestEntity(t, srv, "target body", []string{"ops"})
+	source := createTestEntity(t, srv, "source body", []string{"ops", "infra"})
+
+	resp := postJSON(srv, "/api/entities/"+target.ID+"/absorb", map[string]any{
+		"source_id": source.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("expected 200, got %d", resp.StatusCode)
+	}
+
+	var e EntityResponse
+	json.NewDecoder(resp.Body).Decode(&e)
+	if e.Body != "target body\nsource body" {
+		t.Errorf("merged body: %q", e.Body)
+	}
+	if len(e.Tags) != 2 {
+		t.Errorf("expected 2 tags, got %v", e.Tags)
+	}
+
+	// Source should be soft-deleted (not in default list)
+	listResp, _ := http.Get(srv.URL + "/api/entities")
+	var entities []EntityResponse
+	json.NewDecoder(listResp.Body).Decode(&entities)
+	listResp.Body.Close()
+	for _, ent := range entities {
+		if ent.ID == source.ID {
+			t.Error("source should be soft-deleted and hidden from default list")
+		}
+	}
+}
+
+func TestAbsorbEntity_TargetCrystallized(t *testing.T) {
+	srv, _ := testServer(t)
+	target := createTestEntity(t, srv, "target", nil)
+	source := createTestEntity(t, srv, "source", nil)
+
+	postJSON(srv, "/api/entities/"+target.ID+"/promote", map[string]any{
+		"card_type": "snippet",
+	}).Body.Close()
+
+	resp := postJSON(srv, "/api/entities/"+target.ID+"/absorb", map[string]any{
+		"source_id": source.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+
+	var errResp ErrorResponse
+	json.NewDecoder(resp.Body).Decode(&errResp)
+	if errResp.Error != "invalid_absorb" {
+		t.Errorf("error: %q", errResp.Error)
+	}
+}
+
+func TestAbsorbEntity_SameEntity(t *testing.T) {
+	srv, _ := testServer(t)
+	e := createTestEntity(t, srv, "self", nil)
+
+	resp := postJSON(srv, "/api/entities/"+e.ID+"/absorb", map[string]any{
+		"source_id": e.ID,
+	})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+}
+
+func TestAbsorbEntity_MissingSourceID(t *testing.T) {
+	srv, _ := testServer(t)
+	e := createTestEntity(t, srv, "target", nil)
+
+	resp := postJSON(srv, "/api/entities/"+e.ID+"/absorb", map[string]any{})
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", resp.StatusCode)
+	}
+}
+
 func mustJSON(v any) []byte {
 	b, _ := json.Marshal(v)
 	return b