feat(platform): add resource update safeguards

backend/api/internal/logic/platform/resource.go

@@ -1,5 +1,11 @@
 package platform
 
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
 // ResourceMode describes the operations a platform-admin resource supports.
 type ResourceMode string
 
@@ -17,6 +23,49 @@ type ResourceContract struct {
 	Mode     ResourceMode
 }
 
+// ResourceDefinition describes a route resource and the fields it may change.
+type ResourceDefinition struct {
+	Domain       string
+	Name         string
+	Model        func() any
+	Mode         ResourceMode
+	CreateFields []string
+	UpdateFields []string
+}
+
+// Allows reports whether a resource mode supports an HTTP method.
+func (d ResourceDefinition) Allows(method string) bool {
+	switch d.Mode {
+	case ReadOnly:
+		return method == http.MethodGet
+	case AppendOnly:
+		return method == http.MethodGet || method == http.MethodPost
+	case Writable:
+		return method == http.MethodGet || method == http.MethodPost || method == http.MethodPut || method == http.MethodPatch || method == http.MethodDelete
+	default:
+		return false
+	}
+}
+
+func archiveValues() gin.H {
+	return gin.H{"status": "archived"}
+}
+
+func filterFields(values map[string]any, allowedFields []string) gin.H {
+	allowed := make(map[string]struct{}, len(allowedFields))
+	for _, field := range allowedFields {
+		allowed[field] = struct{}{}
+	}
+
+	filtered := make(gin.H, len(allowed))
+	for field, value := range values {
+		if _, ok := allowed[field]; ok {
+			filtered[field] = value
+		}
+	}
+	return filtered
+}
+
 // ExpectedResources returns the complete platform-admin resource catalogue.
 func ExpectedResources() []ResourceContract {
 	return []ResourceContract{