[BUG] Enforce mutual exclusivity for contact person and organisation

[rishavtarway]

Change(s)

Change Type: Fixed
Change Category: Internal
Changelog Entry: Add API-level validation to reject Contact payloads that set both person and organisation.

How to Test

• python -m pytest src/tests/routers/resource_routers/test_router_contact.py -k person_and_organisation_both_specified -q
• python -m pytest src/tests/routers/resource_routers/test_router_contact.py -q

Checklist

• Tests have been added or updated to reflect the changes, or their absence is explicitly explained.
• Documentation has been added or updated to reflect the changes, or their absence is explicitly explained.
• A self-review has been conducted checking:
  • No unintended changes have been committed.
  • The changes in isolation seem reasonable.
  • Anything that may be odd or unintuitive is provided with a GitHub comment explaining it.
• All CI checks pass before pinging a reviewer, or provide an explanation if they do not.
• The PR title matches the changelog entry's one-line description.

Notes:

• Uses application-level enforcement (as discussed in Reinstate Check Constraints for Contact #518) due MariaDB FK/check constraint limitation.
• Re-enables and updates the existing regression test for this scenario.

Related Issues

Refs #518

[rishavtarway]

Local contact-router tests pass (test_router_contact.py), and the PR scope is limited to application-level validation plus regression test re-enable for #518 .

[rishavtarway]

Quick status update on this PR:

• Scope is limited to application-level mutual-exclusivity validation for Contact (person vs organisation) plus regression test re-enable/update.
• Local checks run:
  • python -m pytest src/tests/routers/resource_routers/test_router_contact.py -k person_and_organisation_both_specified -q
  • python -m pytest src/tests/routers/resource_routers/test_router_contact.py -q
• Current behavior now returns 400 with clear message when both fields are set, matching expected API behavior.