fix(backend): harden final MVP invariants

backend/internal/logic/tasks/concurrency_postgres_test.go

@@ -1,3 +1,5 @@
+//go:build integration
+
 package tasks
 
 import (
@@ -14,10 +16,8 @@ import (
 )
 
 func TestPostgresMovePreventsOldProjectShareFromBeingInsertedConcurrently(t *testing.T) {
-	dsn := os.Getenv("DATABASE_URL")
-	if dsn == "" {
-		t.Skip("DATABASE_URL is not configured; skipping PostgreSQL row-lock concurrency test")
-	}
+	dsn := os.Getenv("TEST_DATABASE_URL")
+	require.NotEmpty(t, dsn, "TEST_DATABASE_URL is required for integration tests and must point to an isolated database")
 	database, err := gorm.Open(postgres.Open(dsn), &gorm.Config{TranslateError: true})
 	require.NoError(t, err)
 	require.NoError(t, models.AutoMigrate(database))

backend/internal/logic/tasks/service.go

@@ -236,14 +236,15 @@ func findOrCreateProjectTag(tx *gorm.DB, projectID uint, value string) (*uint, *
 	if name == "" {
 		return nil, nil, "", nil
 	}
+	candidate := models.SenlinAgentTag{ProjectID: projectID, Name: name}
+	if err := tx.Clauses(clause.OnConflict{
+		Columns:   []clause.Column{{Name: "project_id"}, {Name: "name"}},
+		DoNothing: true,
+	}).Create(&candidate).Error; err != nil {
+		return nil, nil, "", err
+	}
 	var tag models.SenlinAgentTag
-	err := tx.Where("project_id = ? AND name = ?", projectID, name).First(&tag).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		tag = models.SenlinAgentTag{ProjectID: projectID, Name: name}
-		if err := tx.Create(&tag).Error; err != nil {
-			return nil, nil, "", err
-		}
-	} else if err != nil {
+	if err := tx.Where("project_id = ? AND name = ?", projectID, name).First(&tag).Error; err != nil {
 		return nil, nil, "", err
 	}
 	return &tag.ID, &tag.Identity, tag.Name, nil