Enforce brewery ownership on update and delete (#267)

web/backend/Features/Features.Breweries/Commands/CreateBrewery/CreateBreweryCommand.cs

@@ -23,3 +23,10 @@ public record CreateBreweryCommand(
     string Description,
     CreateBreweryLocation Location
 ) : IRequest<BreweryDto>;
+
+/// <summary>Request body for <c>POST /api/brewery</c>. <c>PostedById</c> comes from the caller's JWT.</summary>
+public record CreateBreweryRequest(
+    string BreweryName,
+    string Description,
+    CreateBreweryLocation Location
+);

web/backend/Features/Features.Breweries/Commands/CreateBrewery/CreateBreweryHandler.cs

@@ -37,6 +37,17 @@ public class CreateBreweryHandler(IBreweryRepository repository)
         };
 
         await repository.CreateAsync(entity);
-        return entity.ToDto();
+
+        // RowVersion is a DB-computed column, unset on the in-memory entity; re-fetch so callers
+        // get back the value needed for a subsequent optimistic-concurrency update. Uses
+        // CancellationToken.None since the write already committed: cancelling the caller's request
+        // at this point must not turn a successful creation into a thrown exception.
+        BreweryPost created =
+            await repository.GetByIdAsync(entity.BreweryPostId, CancellationToken.None)
+            ?? throw new InvalidOperationException(
+                $"Brewery '{entity.BreweryPostId}' was not found after a successful creation."
+            );
+
+        return created.ToDto();
     }
 }