fix(vendors): POST upsert replaces metadata on conflict (CodeRabbit)

ON CONFLICT was the one column omitted from the full-overwrite upsert, so a
re-POST kept stale metadata — contradicting the documented "full representation"
contract. Add `metadata = EXCLUDED.metadata` and assert the clobber (set then
reset) in the route spec.

https://claude.ai/code/session_015mkdG1VYH3AdqLe4E3i9H6

Author: claude

src/routes/vendors.ts

@@ -146,6 +146,7 @@ vendorRoutes.post('/', async (c) => {
       status = EXCLUDED.status,
       owner = EXCLUDED.owner,
       account_id = EXCLUDED.account_id,
+      metadata = EXCLUDED.metadata,
       risk_score = EXCLUDED.risk_score,
       updated_at = NOW()
     RETURNING *

tests/routes/vendors.spec.ts

@@ -102,16 +102,20 @@ describe.skipIf(SKIP)('/api/vendors (real Neon)', () => {
       category: 'infra',
       payment_status: 'failed',
       mtd_spend: 200,
+      metadata: { note: 'first' },
     });
     expect(first.status).toBe(201);
     expect(parseFloat(first.json.mtd_spend)).toBe(200);
+    expect(first.json.metadata).toEqual({ note: 'first' });
 
-    // Re-POST with only name+category — documented behaviour resets the rest.
+    // Re-POST with only name+category — documented behaviour resets the rest,
+    // including metadata (ON CONFLICT now assigns metadata = EXCLUDED.metadata).
     const second = await api('POST', '/', { vendor_name: name, category: 'data' });
     expect(second.status).toBe(201);
     expect(second.json.category).toBe('data');
     expect(parseFloat(second.json.mtd_spend)).toBe(0); // clobbered to default
     expect(second.json.payment_status).toBe('unknown'); // clobbered to default
+    expect(second.json.metadata).toEqual({}); // clobbered to default (was {note:'first'})
   });
 
   it('GET /summary returns spend rollups', async () => {