fix: harden competitor create and batch kol stats

server/internal/tenant/app/brand_service.go

@@ -639,6 +639,20 @@ func (s *BrandService) ListCompetitors(ctx context.Context, brandID int64) ([]Co
 
 func (s *BrandService) CreateCompetitor(ctx context.Context, brandID int64, req CompetitorRequest) (*CompetitorResponse, error) {
 	actor := auth.MustActor(ctx)
+	req.Name = strings.TrimSpace(req.Name)
+	req.Website = normalizeOptionalString(req.Website)
+	req.Description = normalizeOptionalString(req.Description)
+	if req.Name == "" {
+		return nil, response.ErrBadRequest(40001, "invalid_params", "name is required")
+	}
+	exists, err := s.brandExists(ctx, actor.TenantID, brandID)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, response.ErrNotFound(40420, "brand_not_found", "brand not found")
+	}
+
 	var plJSON []byte
 	if req.ProductLinesJSON != nil {
 		plJSON = *req.ProductLinesJSON
@@ -646,11 +660,14 @@ func (s *BrandService) CreateCompetitor(ctx context.Context, brandID int64, req
 
 	var id int64
 	var ca interface{}
-	err := s.pool.QueryRow(ctx, `
+	err = s.pool.QueryRow(ctx, `
 		INSERT INTO competitors (tenant_id, brand_id, name, website, description, product_lines_json)
 		VALUES ($1, $2, $3, $4, $5, $6) RETURNING id, created_at
 	`, actor.TenantID, brandID, req.Name, req.Website, req.Description, plJSON).Scan(&id, &ca)
 	if err != nil {
+		if isForeignKeyConstraintError(err) {
+			return nil, response.ErrNotFound(40420, "brand_not_found", "brand not found")
+		}
 		return nil, response.ErrInternal(50010, "create_failed", "failed to create competitor")
 	}
 	invalidateBrandCaches(ctx, s.cache, actor.TenantID, brandID)