Onboarding: template backlink, bulk-create endpoint, climate-region scoring

Clients that send users through a multi-task onboarding step no longer
loop N POST /api/tasks/ calls and no longer create "orphan" tasks with
no reference to the TaskTemplate they came from.

Task model
- New task_template_id column + GORM FK (migration 000016)
- CreateTaskRequest.template_id, TaskResponse.template_id
- task_service.CreateTask persists the backlink

Bulk endpoint
- POST /api/tasks/bulk/ — 1-50 tasks in a single transaction,
  returns every created row + TotalSummary. Single residence access
  check, per-entry residence_id is overridden with batch value
- task_handler.BulkCreateTasks + task_service.BulkCreateTasks using
  db.Transaction; task_repo.CreateTx + FindByIDTx helpers

Climate-region scoring
- templateConditions gains ClimateRegionID; suggestion_service scores
  residence.PostalCode -> ZipToState -> GetClimateRegionIDByState against
  the template's conditions JSON (no penalty on mismatch / unknown ZIP)
- regionMatchBonus 0.35, totalProfileFields 14 -> 15
- Standalone GET /api/tasks/templates/by-region/ removed; legacy
  task_tasktemplate_regions many-to-many dropped (migration 000017).
  Region affinity now lives entirely in the template's conditions JSON

Tests
- +11 cases across task_service_test, task_handler_test, suggestion_
  service_test: template_id persistence, bulk rollback + cap + auth,
  region match / mismatch / no-ZIP / unknown-ZIP / stacks-with-others

Docs
- docs/openapi.yaml: /tasks/bulk/ + BulkCreateTasks schemas, template_id
  on TaskResponse + CreateTaskRequest, /templates/by-region/ removed

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/handlers/task_handler_test.go

@@ -30,6 +30,74 @@ func setupTaskHandler(t *testing.T) (*TaskHandler, *echo.Echo, *gorm.DB) {
 	return handler, e, db
 }
 
+func TestTaskHandler_BulkCreateTasks(t *testing.T) {
+	handler, e, db := setupTaskHandler(t)
+	testutil.SeedLookupData(t, db)
+	user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
+	residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
+
+	tmpl := models.TaskTemplate{Title: "Change HVAC Filter", IsActive: true}
+	require.NoError(t, db.Create(&tmpl).Error)
+
+	authGroup := e.Group("/api/tasks")
+	authGroup.Use(testutil.MockAuthMiddleware(user))
+	authGroup.POST("/bulk/", handler.BulkCreateTasks)
+
+	t.Run("creates all tasks and returns 201", func(t *testing.T) {
+		req := requests.BulkCreateTasksRequest{
+			ResidenceID: residence.ID,
+			Tasks: []requests.CreateTaskRequest{
+				{ResidenceID: residence.ID, Title: "Bulk A", TemplateID: &tmpl.ID},
+				{ResidenceID: residence.ID, Title: "Bulk B"},
+			},
+		}
+		w := testutil.MakeRequest(e, "POST", "/api/tasks/bulk/", req, "test-token")
+		testutil.AssertStatusCode(t, w, http.StatusCreated)
+
+		var response map[string]interface{}
+		require.NoError(t, json.Unmarshal(w.Body.Bytes(), &response))
+		assert.EqualValues(t, 2, response["created_count"])
+		tasks := response["tasks"].([]interface{})
+		require.Len(t, tasks, 2)
+		first := tasks[0].(map[string]interface{})
+		require.NotNil(t, first["template_id"])
+		assert.EqualValues(t, tmpl.ID, first["template_id"])
+	})
+
+	t.Run("empty task list returns 400", func(t *testing.T) {
+		req := requests.BulkCreateTasksRequest{
+			ResidenceID: residence.ID,
+			Tasks:       []requests.CreateTaskRequest{},
+		}
+		w := testutil.MakeRequest(e, "POST", "/api/tasks/bulk/", req, "test-token")
+		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
+	})
+
+	t.Run("more than 50 tasks rejected by validator", func(t *testing.T) {
+		big := make([]requests.CreateTaskRequest, 51)
+		for i := range big {
+			big[i] = requests.CreateTaskRequest{ResidenceID: residence.ID, Title: "n"}
+		}
+		req := requests.BulkCreateTasksRequest{ResidenceID: residence.ID, Tasks: big}
+		w := testutil.MakeRequest(e, "POST", "/api/tasks/bulk/", req, "test-token")
+		testutil.AssertStatusCode(t, w, http.StatusBadRequest)
+	})
+
+	t.Run("foreign residence returns 403", func(t *testing.T) {
+		foreigner := testutil.CreateTestUser(t, db, "intruder", "intruder@test.com", "password")
+		foreignerResidence := testutil.CreateTestResidence(t, db, foreigner.ID, "Not Yours")
+
+		req := requests.BulkCreateTasksRequest{
+			ResidenceID: foreignerResidence.ID,
+			Tasks: []requests.CreateTaskRequest{
+				{ResidenceID: foreignerResidence.ID, Title: "Nope"},
+			},
+		}
+		w := testutil.MakeRequest(e, "POST", "/api/tasks/bulk/", req, "test-token")
+		testutil.AssertStatusCode(t, w, http.StatusForbidden)
+	})
+}
+
 func TestTaskHandler_CreateTask(t *testing.T) {
 	handler, e, db := setupTaskHandler(t)
 	testutil.SeedLookupData(t, db)