feat(l1): PATCH /accounts/me/members/{id}/coverage for engineer L1-coverage flag

Owner-only endpoint to toggle can_cover_l1 on an engineer user. 422 if target
role is not engineer (owners/super_admins already see L1 surface; viewers/
l1_techs don't need this flag). 404 for cross-account targets.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/app/api/endpoints/accounts.py

@@ -21,7 +21,7 @@ from app.models.subscription import Subscription
 from app.models.user import User
 from app.schemas.account import AccountResponse, AccountUpdate, AccountInviteCreate, AccountInviteResponse, AccountInviteBulkCreate, AccountInviteBulkResponse, TransferOwnershipRequest
 from app.schemas.subscription import SubscriptionResponse, PlanLimitsResponse, UsageResponse, SubscriptionDetails
-from app.schemas.user import UserResponse, AccountRoleUpdate
+from app.schemas.user import UserResponse, AccountRoleUpdate, CoverageUpdate
 from app.core.security import verify_password
 from app.api.deps import get_current_active_user, require_account_owner, require_engineer_or_admin
 from app.services.seat_enforcement import check_seat_available, get_seat_usage
@@ -228,6 +228,43 @@ async def update_member_role(
     return user
 
 
+@router.patch("/me/members/{user_id}/coverage", response_model=UserResponse)
+async def update_member_coverage(
+    user_id: UUID,
+    data: CoverageUpdate,
+    db: Annotated[AsyncSession, Depends(get_db)],
+    current_user: Annotated[User, Depends(require_account_owner)],
+):
+    """Toggle the `can_cover_l1` flag on an engineer in your account.
+
+    Owner-only. Returns 404 if target user not in your account. Returns 422
+    if target user's role is not 'engineer' (coverage flag only applies to
+    engineers — owners/super_admins already see L1 surface; viewers/l1_techs
+    don't need this flag).
+    """
+    result = await db.execute(
+        select(User).where(
+            User.id == user_id,
+            User.account_id == current_user.account_id,
+        )
+    )
+    target = result.scalar_one_or_none()
+    if target is None:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found in your account",
+        )
+    if target.account_role != "engineer":
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            detail="can_cover_l1 only applies to engineers",
+        )
+    target.can_cover_l1 = data.can_cover_l1
+    await db.commit()
+    await db.refresh(target)
+    return target
+
+
 @router.post("/me/transfer-ownership", response_model=AccountResponse)
 async def transfer_ownership(
     data: TransferOwnershipRequest,

backend/app/schemas/user.py

@@ -60,6 +60,7 @@ class UserResponse(UserBase):
     email_verified_at: Optional[datetime] = None
     onboarding_step_completed: Optional[int] = None
     onboarding_dismissed: bool = False
+    can_cover_l1: bool = False
 
     class Config:
         from_attributes = True
@@ -73,3 +74,7 @@ class AccountRoleUpdate(BaseModel):
     # Ownership changes must go through the explicit transfer-ownership flow so
     # account.owner_id stays consistent with user.account_role.
     account_role: str = Field(..., pattern="^(admin|engineer|viewer|l1_tech)$")
+
+
+class CoverageUpdate(BaseModel):
+    can_cover_l1: bool