Relationship editing command surface + required last-edge protection (#1918)

[mstomar125]

Part of #1918 (relationship viewer). Follow-up to the read-only first slice (#1992). Does not close #1918 — the editable-modal UI, target picker, and view-settings remain.

What this ships

The backend command surface for editing typed relationships, end to end (proto → daemon → core → Tauri), so the viewer can populate edges rather than only list them — slice (a) editing + slice (b) enforcement:

core

• SqliteStore::update_relationship_properties — replaces an edge's properties JSON wholesale, bumps version/modified_at; returns None when the edge is absent.
• NodeService::update_relationship_properties — errors on a missing edge (no silent no-op), emits RelationshipUpdated.
• NodeService::delete_relationship — required last-edge guard: rejects removing the final edge of a relationship declared required: true. Only blocks when the targeted edge exists and it's the last one; non-last removals and built-ins are unaffected.
• rel_ops::update_relationship_properties op.

proto / daemon

• New DeleteRelationship + UpdateRelationshipProperties RPCs (create RPC already existed); daemon handlers forward to rel_ops.

Tauri (desktop-app)

• create_relationship, delete_relationship, update_relationship_properties commands, registered in lib.rs.

Not in this PR

Cardinality-One rejection on create was already enforced on main; this adds the delete and edit halves. The editable modal, target-selection picker, and view-settings are separate follow-up slices.

Tests

New packages/core/tests/relationship_editing_test.rs (4 tests): edit round-trip overwrites edge attributes; update on a missing edge errors; required last-edge protection across add/remove sequences; a non-required relationship allows deleting its last edge. Full cargo test -p nodespace-core relationship green (47 tests), cargo build -p nodespace-daemon -p nodespace-app clean, cargo clippy + fmt clean. Pre-push gate (test:all + build + e2e) passed.

[mstomar125]

Adversarial review → addressed → APPROVE.

Independent review flagged one blocker + four minors; all addressed in the follow-up commit:

• [blocker] Validation rejections surfaced as gRPC INTERNAL. The ops layer wrapped every NodeService error in OpsError::Internal, so the required-last-edge and missing-edge rejections — the whole point of the guard — reached the frontend as an opaque server fault instead of a distinguishable validation error. Fixed: create/delete/update ops now map via the existing OpsError::from (InvalidUpdate → ValidationFailed → INVALID_ARGUMENT, NodeNotFound → NotFound). Added a regression test asserting the required-last-edge delete returns ValidationFailed, not Internal.
• [minor] Guard failed open silently on an unparseable schema relationships array → now warns instead of silently disabling protection.
• [minor] required read regardless of direction → now only enforced for a forward (direction: out) relationship, so an inbound declaration never counts the wrong edge set.
• [minor] Non-object edge properties accepted on update → now rejected (scalar/array/null), with a test confirming a rejected update leaves the edge untouched.
• [minor] TOCTOU between the edge count and the delete → acknowledged; accepted as-is (single-user local daemon, and identical to create_relationship's existing cardinality check).

The "last-edge" identification logic — the headline concern — was confirmed correct (specific-edge relationship_exists AND count, blocking only when edge_exists && total <= 1; consistent in_node = source column usage). Tests now 6/6; cargo clippy + fmt clean; re-pushing through the full pre-push gate.

Verdict: APPROVE.