Expose resource attribution (source + URL) in the REST API #651

Description

Metron records where some descriptive content came from (for example, a character bio adapted from Wikipedia or Marvel) using the Attribution model. These attributions show on the website, but no API endpoint returns them. API consumers that copy desc or other text into their own apps (taggers, library managers, and so on) can't credit the original source, even though licenses like Wikipedia's CC BY-SA require it.

Proposal

Add a read-only attribution array to the detail (retrieve) responses for:

• /api/arc/{id}/
• /api/character/{id}/
• /api/creator/{id}/
• /api/imprint/{id}/
• /api/issue/{id}/
• /api/publisher/{id}/
• /api/series/{id}/
• /api/team/{id}/
• /api/universe/{id}/

Example:

{
  "id": 1234,
  "name": "Spider-Man",
  "desc": "...",
  "attribution": [
    {"source": "Wikipedia", "url": "https://en.wikipedia.org/wiki/Spider-Man"},
    {"source": "Marvel", "url": "https://www.marvel.com/characters/spider-man-peter-parker"}
  ],
  "resource_url": "...",
  "modified": "..."
}

Implementation notes

• Add an AttributionSerializer with source as the display value (get_source_display, matching how Reading List exposes attribution_source) and url.
• Nest it as attribution = AttributionSerializer(many=True, read_only=True) on each *ReadSerializer, and add "attribution" to Meta.fields.
• Add prefetch_related("attribution") to each retrieve queryset to avoid N+1 queries.
• Keep it out of list endpoints, which stay minimal.
• Leave it read-only for now. Writing attributions through the API (create/update with a nested writable field) can be a follow-up.
• Cache/conditional requests: make sure adding, editing or deleting an Attribution invalidates the parent's cached detail response and its Last-Modified. Either bump the parent's modified with a post_save/post_delete signal on Attribution, or confirm the web edit views always save the parent.
• Regenerate the OpenAPI schema and update api/README.md.

Implementation checklist

• Detail responses for all nine resources include an attribution list, which is empty when there's no attribution.
• source is returned as a readable label (Wikipedia, Marvel, Grand Comics Database, DC).
• Adding or changing an attribution is reflected in the API without waiting for the cache TTL to expire.
• No additional queries per object on the retrieve endpoints.
• Tests cover serializer output and cache invalidation.

Benefit

Downstream apps can credit sources correctly, which helps keep Metron's data use license-compliant across the ecosystem.