Add isolated resource tag manager service

[gearnode]

Summary

Adds pkg/resourcetag, an isolated tag manager in the same style as pkg/resourcealias: org-scoped catalog, attach/detach to any resource GID, package-owned IAM/OAuth.

Model

• Catalog (resource_tags): key (slug, unique per org), value, optional color (#RGB / #RRGGBB)
• Assignments (resource_tag_assignments): M:N with own GID; unique (resource_id, tag_id); deleting a tag cascades assignments
• No entity field resolvers yet (Document/Risk/etc.) — deferred to a follow-up PR

Surfaces

• Console GraphQL: catalog CRUD, attach/detach, Organization.resourceTags, resourceTagsForResource, ResourceTag.assignments (cursor connection)
• MCP tools, CLI (prb resource-tag / rt), n8n resource
• E2E for console + MCP

Filter readiness

• FilterResourceIDs (AND semantics) and LoadByResourceIDs are in the service for the next PR that wires tags onto entity list queries / field resolvers.

Test plan

• Apply migration; create tag with key/value/color; list via Organization.resourceTags
• Duplicate key returns conflict
• Attach tag to a document; list via resourceTagsForResource; duplicate attach conflicts
• List assignments on a tag with pagination / totalCount
• Detach; delete tag cascades assignments
• MCP create/attach/list/detach/delete tools
• CLI prb resource-tag create|list|attach|detach|delete

  

---

Summary by cubic

Adds pkg/resourcetag, an org-scoped tag manager (like pkg/resourcealias) to create, list, update, delete, and attach/detach tags across any resource. Includes migrations, a hex color validator, and a cursor-paginated assignments connection with assignment GIDs; entity field resolvers ship in a follow-up.

Coredata +1005 -0

• Added resource_tags and resource_tag_assignments tables with cascade on delete.
• Implemented models, ordering, entity type registration; assignments have their own GID for pagination.

Service +729 -2

• Introduced pkg/resourcetag with CRUD, attach/detach, and filter helpers (FilterResourceIDs, LoadByResourceIDs).
• Added IAM policies and OAuth scopes; wired into pkg/probod and server config.
• Added HexColor validator for #RGB/#RRGGBB.

GraphQL API +716 -0

• Console schema and resolvers for catalog CRUD, attach/detach, org/resource queries, and Node support for ResourceTag.
• Added ResourceTag.assignments cursor connection; wired service into handlers.

MCP +503 -0

• Tools for create/list/update/attach/detach/delete tags.
• Updated spec and types; resolvers call pkg/resourcetag.

prb (CLI) +1065 -0

• New prb resource-tag commands: create, list, update, delete, attach, detach.
• Registered under the root command.

Package: n8n-node +680 -0

• New resourceTag resource with create/list/update/attach/detach/delete.
• Added to the Probo node menu.

Tests +499 -0

• E2E coverage for Console GraphQL and MCP tag flows, including assignments pagination.
• Unit tests for the HexColor validator.

^{Written for commit daf26f2. Summary will update on new commits.}