fix(#2): add /add endpoint returning 201 Created

[fullsend-ai-coder]

The /add endpoint was missing from the application. Added a POST /add endpoint that accepts JSON with "a" and "b" numeric fields, returns their sum as {"result": } with HTTP 201 Created status. Includes input validation for missing fields and non-numeric types (returns 400).

Added tests covering the happy path, missing fields, and invalid type inputs.

---

Closes #2

Post-script verification

• Branch is not main/master (agent/2-add-endpoint-201)
• Secret scan passed (gitleaks — 47f7f1511df8ad7036c082d9b2179085cd9ec107..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[fullsend-ai-review]

Review

Findings

Medium

• [logic-error] app.py:69 — The + operator only raises TypeError when operands are incompatible types (e.g., string + int). Two strings ({"a": "foo", "b": "bar"}) concatenate successfully, returning {"result": "foobar"} with 201 — violating the endpoint's numeric addition contract. Similarly, two lists would concatenate.
  Remediation: Validate that both a and b are int or float before performing addition, e.g., if not isinstance(data['a'], (int, float)) or not isinstance(data['b'], (int, float)). Note that bool is a subclass of int in Python, so exclude it if booleans should be rejected.

• [missing-doc] README.md:7 — The Endpoints table documents all API routes but does not include the new POST /add endpoint, making the API reference incomplete.
  Remediation: Add a row to the endpoints table: | POST | /add | Add two numbers ({"a": ..., "b": ...}) |

• [tier-mismatch] app.py:65 — Issue Bug: /add endpoint returns 200 instead of 201 for new calculations #2 describes a bug ("the /add endpoint returns 200 instead of 201") implying the endpoint already exists, but the main branch has no /add endpoint. This PR adds a new feature rather than fixing an existing bug. The PR title fix(#2) misrepresents the change tier.
  Remediation: If this is intended as a new feature, update the issue label and PR title to reflect feat rather than fix.

Low

• [test-inadequate] test_app.py:76 — Tests do not cover the string-concatenation edge case ({"a": "foo", "b": "bar"}), booleans, lists, or null values for a/b. See also: [logic-error] finding at app.py:69.

• [edge-case] app.py:67 — When no JSON body is sent, request.get_json() returns None (handled correctly by the not data check), but the error message "both 'a' and 'b' are required" is slightly misleading for a missing request body.

• [design-smell] app.py:65 — The /add calculator endpoint is architecturally distinct from the existing TODO-list domain endpoints (/items/*). The README describes this as "A simple Flask REST API for managing a todo list." Worth considering whether arithmetic operations belong in the same service.

• [error-handling-idiom] app.py:68 — Error messages use quoted field names ('a' and 'b') while the existing codebase uses unquoted names (e.g., "name is required" at line 27). Minor inconsistency — quoting is arguably clearer for single-character field names.