phase7: add minimal read-only drf api with player search endpoints

tests/test_api.py

@@ -0,0 +1,59 @@
+from datetime import date
+
+import pytest
+from django.urls import reverse
+
+from apps.competitions.models import Competition, Season
+from apps.players.models import Nationality, Player, Position, Role
+from apps.teams.models import Team
+
+
+@pytest.mark.django_db
+def test_players_api_list_and_detail(client):
+    nationality = Nationality.objects.create(name="Italy", iso2_code="IT", iso3_code="ITA")
+    position = Position.objects.create(code="PG", name="Point Guard")
+    role = Role.objects.create(code="playmaker", name="Playmaker")
+
+    player = Player.objects.create(
+        first_name="Marco",
+        last_name="Rossi",
+        full_name="Marco Rossi",
+        birth_date=date(2001, 1, 5),
+        nationality=nationality,
+        nominal_position=position,
+        inferred_role=role,
+        height_cm=190,
+        weight_kg=84,
+    )
+
+    list_response = client.get(reverse("api:players"), data={"q": "rossi"})
+    assert list_response.status_code == 200
+    assert list_response.json()["count"] == 1
+
+    detail_response = client.get(reverse("api:player_detail", kwargs={"pk": player.pk}))
+    assert detail_response.status_code == 200
+    assert detail_response.json()["full_name"] == "Marco Rossi"
+
+
+@pytest.mark.django_db
+def test_lookup_list_endpoints(client):
+    nationality = Nationality.objects.create(name="Spain", iso2_code="ES", iso3_code="ESP")
+    Competition.objects.create(
+        name="Liga ACB",
+        slug="liga-acb",
+        competition_type=Competition.CompetitionType.LEAGUE,
+        gender=Competition.Gender.MEN,
+        country=nationality,
+    )
+    Team.objects.create(name="Madrid Flight", slug="madrid-flight", country=nationality)
+    Season.objects.create(label="2025-2026", start_date=date(2025, 9, 1), end_date=date(2026, 6, 30), is_current=True)
+
+    assert client.get(reverse("api:competitions")).status_code == 200
+    assert client.get(reverse("api:teams")).status_code == 200
+    assert client.get(reverse("api:seasons")).status_code == 200
+
+
+@pytest.mark.django_db
+def test_api_is_read_only(client):
+    response = client.post(reverse("api:players"), data={"q": "x"})
+    assert response.status_code == 403