Adds repowise.core.ingestion.external_systems, a self-contained subpackage
that walks a repo, finds package.json / pyproject.toml / requirements*.txt,
and returns ExternalSystemRecord rows with name + version + ecosystem
+ category. The category is a small dictionary-based heuristic (no LLM)
that flags frameworks vs services vs tools vs plain libraries — used by
the C4 renderer to group/icon external systems sensibly.

Each ecosystem lives in its own ~100-line module so adding a new
ecosystem is a new file, not edits across the suite. Parsers never raise
on malformed input (a broken manifest must not break ingestion).

Completes external system extraction for the languages repowise already
indexes. Each parser stays under ~100 lines and skips first-party
references — Cargo path/git deps, Go local replace directives,
.NET ProjectReference — so workspace members never leak into the
external systems list.

PipelineResult.external_systems now carries the list of declared deps
parsed from manifests during _run_ingestion. persist_pipeline_result
upserts them and then walks graph_nodes named 'external:<dep>' to fill
in the new external_system_id FK so the C4 builder can render real
typed boxes instead of bare strings.

Suffix-then-prefix matching handles common forms:
    external:fastapi          -> fastapi          (exact)
    external:fastapi.responses -> fastapi         (first dotted seg)
    external:@scope/pkg/sub    -> @scope/pkg/sub  (exact then segment)

bulk_upsert_external_systems also returns id_map so callers can do
the FK linkage without an extra round-trip; collapsing across
multi-manifest declarations picks any id (name/category are stable).

Derives C4 L1/L2/L3 from already-persisted graph + external_systems data
— no on-disk re-scan at request time, so hosted backends without
filesystem access work too.

Container detection re-uses the manifest paths stored in
external_systems.declared_in: every parent of a declared manifest is a
container root. Repos without manifests fall back to top-level dirs.
Components are top-level subdirs inside the container; root-level files
land in a synthetic _root bucket so they don't disappear from the
diagram.

Relations are rolled up from graph_edges: file→file edges are grouped
by (source_container, target_container, edge_type) at L2 and by their
component equivalents at L3. External-system edges piggyback on the
external_system_id FK populated during ingestion — unresolved
external:* nodes are dropped (a blank box is worse than no box).

All dataclasses live in models.py and are SQLAlchemy/Pydantic-free so
they can be unit-tested without a session and re-used by the Phase 3
Mermaid emitter.

Three new routes under the existing /api/graph prefix:
    GET /api/graph/{repo_id}/c4/l1
    GET /api/graph/{repo_id}/c4/l2
    GET /api/graph/{repo_id}/c4/l3?container_id=...

Router is a thin adapter over services/c4_builder — the only logic here
is dataclass → Pydantic conversion plus a 404 when an L3 container_id
doesn't resolve. Schemas live in server/schemas.py next to the rest of
the response models so OpenAPI generation picks them up uniformly.

Parser tests use tmp_path fixtures with realistic but minimal manifests
and cover: dependency extraction, dev/optional bucketing, version
parsing, malformed-input safety, workspace/local-path skipping, scope
prefix handling for npm, Poetry vs PEP 621 for pypi, // indirect and
local replace for Go, ProjectReference vs PackageReference for nuget,
and the classifier's framework/service/tool/library buckets.

c4_builder tests seed a two-container monorepo (packages/core +
packages/web) with one cross-edge and two external deps, then assert
L1 lists all externals, L2 detects both containers + the cross edge
+ the external edges (with no self-loops), and L3 returns the right
components for one container while filtering externals to only those
actually referenced from inside it. L3 also returns None for unknown
containers.

Hits the C4 router through an httpx AsyncClient + ASGITransport stack
with a fresh in-memory SQLite per test. Each test seeds the graph
directly via crud helpers (no fake LLM, no ingestion pipeline) so the
endpoint behaviour can be asserted in isolation.

Covers:
    - L1 returns system + user actor + every external
    - L1 on an empty repo still returns the system + zero externals
    - L2 detects containers, rolls file edges into container edges,
      links external_system_id-backed nodes to ext:* targets
    - L3 requires container_id (422 without it)
    - L3 returns components for a known container + filters externals
    - L3 returns 404 for an unknown container

Adds the c4 router to the test app and inlines create_test_repo to keep
the module collectable on its own — several existing server tests fail
to collect standalone because of how pytest resolves tests.unit.server,
and the new file shouldn't inherit that breakage.

…mponent)

…nent nodes