[Feature] Create Quest backend logic

[karastoyanov]

✨ Feature Description

Allow admins to create a new coding quest via a POST /api/quests endpoint. All required fields must be validated before persisting the new Quest record to the coding_quests table.

🧩 Problem Statement

There is currently no endpoint to create quests programmatically. Admins need a validated API to add new quests to the platform without touching the database directly.

💡 Proposed Solution

Add a POST /api/quests endpoint protected by admin-only auth. The route handler delegates to QuestService.create_quest(payload), which validates the payload and persists the new record. The id, created_at, updated_at, and solved_times fields are auto-generated and must not be accepted from the request body.

Required Fields (nullable=False)

language          = db.Column(db.String(50),  nullable=False)
difficulty        = db.Column(db.String(50),  nullable=False)
quest_name        = db.Column(db.String(255), nullable=False)
quest_author      = db.Column(db.String(255), nullable=False)
condition         = db.Column(db.Text,        nullable=False)
function_template = db.Column(db.Text,        nullable=False)
input_0           = db.Column(db.Text,        nullable=False)  # null/edge-case test
output_0          = db.Column(db.Text,        nullable=False)  # null/edge-case test

Optional Fields (nullable=True)

input_1  … input_9  = db.Column(db.Text, nullable=True)
output_1 … output_9 = db.Column(db.Text, nullable=True)
example_solution    = db.Column(db.Text, nullable=True)

Auto-generated Fields (never accepted from request)

id          # uuid4 generated automatically
solved_times  # defaults to 0
created_at  # set by the database on insert
updated_at  # set by the database on insert

Error Responses

Status	Scenario
400	Validation failure — missing or invalid required field
403	Requester is not an admin

🔄 Alternatives Considered

Accepting quest_author from the auth token — rather than requiring it in the payload, the author could be derived from the logged-in admin's identity. Kept as an explicit field for now to allow admins to assign authorship freely.

📋 Acceptance Criteria

• A POST /api/quests endpoint exists and is accessible only to admins
• All nullable=False fields are required — missing any returns 400 Bad Request with descriptive errors
• input_0 and output_0 are required (null/edge-case test)
• input_1–9, output_1–9, and example_solution are optional
• id, solved_times, created_at, and updated_at are auto-generated and ignored if sent in the request body
• On success, returns 201 Created with the serialized quest object
• Unauthorized requests return 403 Forbidden
• A service layer method create_quest(payload) encapsulates the business logic
• Unit tests cover: successful creation, each missing required field, and unauthorized access

🔗 Related Issues / Links

📎 Additional Context

• input_0 / output_0 being nullable=False differs from input_1–9 / output_1–9 — validation must reflect this distinction explicitly.