v0.48.0 — SLICE-2: collection field schema + central validation (§22.4a)

Collections declare a `fields:` schema in `.collection.yaml`; entries carry
typed metadata (enum/tags/text). New central `metadata_schema` module parses
the schema leniently (INV-3) and validates entry values — advisory at read
(corpus mirror flags violations as `metadata_malformed` without hard-failing),
the enforcement point for the write boundary (edit endpoints land SLICE-4/5).

- app/metadata_schema.py: parse_fields (lenient/normalizing) + validate
- registry.parse_collection_manifest reads `fields:` into collection config
- collections.get_collection unpacks `fields`; served by the collection API
- cache._refresh_collection_corpus validates each entry advisory-only

Non-breaking, opt-in: no `fields:` → unchanged (INV-5); default `document`
collection declares none (N=1 unchanged). No DB migration — schema rides in
collections.config_json. SLICE-2 of
docs/design/2026-06-06-configurable-collection-metadata.md §7.2.

Backend suite green (601 passed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/cache.py

@@ -28,9 +28,11 @@ import json
 import logging
 
 from . import (
+    collections as collections_mod,
     db,
     entry as entry_mod,
     metadata as metadata_mod,
+    metadata_schema,
     projects as projects_mod,
     registry as registry_mod,
 )
@@ -83,6 +85,13 @@ async def _refresh_collection_corpus(
                     project_id, collection_id, rfcs_dir, e)
         return
 
+    # §22.4a SLICE-2: a collection may declare a metadata field schema. Fetch it
+    # once for the whole corpus pass; entries whose stored values fail it are
+    # flagged malformed advisory-only (INV-3) — the read never hard-fails. A
+    # collection with no schema validates nothing (INV-5, the default unchanged).
+    col = collections_mod.get_collection(collection_id)
+    fields_schema = (col or {}).get("fields") or None
+
     # §22.4a SLICE-1: an entry's metadata may live in a `<slug>.meta.yaml`
     # sidecar (the source of truth) with the `.md` kept as pure prose. Map the
     # sidecars surfaced by this listing so each `.md` can dual-read its sibling.
@@ -119,6 +128,18 @@ async def _refresh_collection_corpus(
         if malformed:
             log.warning("refresh_meta_repo: %s/%s: %s has malformed metadata sidecar",
                         project_id, collection_id, f["path"])
+        # §22.4a SLICE-2: advisory schema validation (INV-3). A schema violation
+        # flags the entry malformed without blocking the read, OR-ed onto any
+        # sidecar-syntax malformation above.
+        if fields_schema:
+            problems = metadata_schema.validate(
+                metadata_mod.metadata_dict(entry), fields_schema
+            )
+            if problems:
+                malformed = True
+                log.warning("refresh_meta_repo: %s/%s: %s fails its field schema: %s",
+                            project_id, collection_id, f["path"],
+                            "; ".join(p.message for p in problems))
         seen_slugs.add(entry.slug)
         _upsert_cached_rfc(entry, body_sha=sha, collection_id=collection_id,
                            metadata_malformed=malformed)