Make repository list() reject unrecognised filter names

Repository.list(**filters) let each implementation pick out the filter
names it understood and silently ignore the rest, so a typo or an
unsupported filter returned every row in the table instead of an error.

This was hit for real: LeaveWishRepository.list(parent_personal_data_uuid
=...) returns every wish in the database, because that implementation
only recognises workspace_id and child_id. A guard written on top of it
would have passed while checking nothing.

All ten implementations now validate against their supported set and
raise ValueError naming the offending key. ValueError rather than a
domain error because passing a filter that does not exist is a
programming bug to fix, not a runtime condition to handle -- it must not
become an HTTP 4xx.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RXMhc9nT6sNz1SL4j8dznL

backend/tests/unit/test_personal_data_repository.py

@@ -9,6 +9,8 @@ this file targets the new column's round trip specifically.
 from datetime import datetime
 from uuid import uuid4
 
+import pytest
+
 from app.entities.personal_data import PersonalData
 from app.entities.workspace import Workspace
 from app.repositories_impl.sqlite.personal_data_repository import SQLitePersonalDataRepository
@@ -75,3 +77,43 @@ class TestPersonalDataMinVacationDays:
         fetched = await personal_data_repo.get_by_id(created.uuid)
         assert fetched is not None
         assert fetched.min_vacation_days_per_year == 15
+
+    async def test_list_rejects_unsupported_filter(
+        self,
+        personal_data_repo: SQLitePersonalDataRepository,
+    ) -> None:
+        """Passing an unsupported filter must raise ValueError."""
+        with pytest.raises(ValueError, match="invalid_column"):
+            await personal_data_repo.list(invalid_column="value")
+
+    async def test_list_accepts_include_deleted_filter(
+        self,
+        personal_data_repo: SQLitePersonalDataRepository,
+        workspace_repo: SQLiteWorkspaceRepository,
+    ) -> None:
+        """The SoftDeleteRepository contract requires list() to accept include_deleted=True."""
+        ws = await workspace_repo.create(
+            Workspace(id=uuid4(), name="WS", created_at=datetime.now())
+        )
+        pd = await personal_data_repo.create(
+            PersonalData(uuid=uuid4(), workspace_id=ws.id, name="Parent", created_at=datetime.now())
+        )
+
+        # By default, deleted items should not be listed
+        await personal_data_repo.soft_delete(pd.uuid)
+        rows = await personal_data_repo.list(workspace_id=ws.id)
+        ids = {r.uuid for r in rows}
+        assert pd.uuid not in ids
+
+        # With include_deleted=True, deleted items should be included
+        rows_with_deleted = await personal_data_repo.list(workspace_id=ws.id, include_deleted=True)
+        ids_with_deleted = {r.uuid for r in rows_with_deleted}
+        assert pd.uuid in ids_with_deleted
+
+    async def test_list_error_message_lists_supported_filters(
+        self,
+        personal_data_repo: SQLitePersonalDataRepository,
+    ) -> None:
+        """Error message should list supported filters."""
+        with pytest.raises(ValueError, match="include_deleted.*workspace_id"):
+            await personal_data_repo.list(bad_filter="value")