feat: add Module 04 — FastAPI Web Apps curriculum

Five progressive projects teaching FastAPI from first endpoint to
production-quality authenticated API with tests. Covers uvicorn,
Pydantic validation, SQLAlchemy ORM, JWT auth, CORS, and TestClient.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: travisjneuman

projects/modules/04-fastapi-web/01-hello-fastapi/README.md

@@ -0,0 +1,84 @@
+# Module 04 / Project 01 — Hello FastAPI
+
+Home: [README](../../../../README.md)
+
+## Focus
+
+First endpoint, running with uvicorn, automatic interactive docs at `/docs`.
+
+## Why this project exists
+
+FastAPI is the fastest way to build a Python web API. This project gets you from zero to a running server in minutes. You will create your first endpoint, learn how FastAPI turns decorators into routes, and discover the automatic documentation that makes testing your API effortless.
+
+## Run
+
+```bash
+cd projects/modules/04-fastapi-web/01-hello-fastapi
+python app.py
+```
+
+Then open your browser to:
+
+- **http://127.0.0.1:8000** — your root endpoint
+- **http://127.0.0.1:8000/docs** — interactive Swagger UI documentation
+- **http://127.0.0.1:8000/items/42?q=hello** — path and query parameters in action
+
+Press `Ctrl+C` in the terminal to stop the server.
+
+## Expected output
+
+Visiting `http://127.0.0.1:8000` returns:
+
+```json
+{"message": "Hello, FastAPI!"}
+```
+
+Visiting `http://127.0.0.1:8000/items/42?q=hello` returns:
+
+```json
+{"item_id": 42, "q": "hello"}
+```
+
+Visiting `http://127.0.0.1:8000/health` returns:
+
+```json
+{"status": "healthy"}
+```
+
+## Alter it
+
+1. Add a new `GET /greet/{name}` endpoint that returns `{"greeting": "Hello, {name}!"}`.
+2. Add an optional query parameter `uppercase` (bool) to the greet endpoint. When true, return the greeting in all caps.
+3. Add a `GET /add/{a}/{b}` endpoint that takes two integers and returns their sum.
+
+## Break it
+
+1. Change the decorator from `@app.get("/")` to `@app.get` (remove the parentheses and path). What error do you get?
+2. Try visiting `http://127.0.0.1:8000/items/not-a-number`. What does FastAPI return? Why?
+3. Change `item_id: int` to `item_id: str` in the function signature. How does the `/docs` page change?
+
+## Fix it
+
+1. After removing the parentheses, put them back and add the path string. Confirm the endpoint works again.
+2. The 422 error from passing a non-integer is FastAPI's automatic validation. There is nothing to fix because validation is the correct behavior. Explain why in your notes.
+3. Restore the `int` type hint. Notice how FastAPI uses Python type hints to validate inputs automatically.
+
+## Explain it
+
+1. What does the `@app.get("/")` decorator do? What happens if two routes have the same path?
+2. What is the difference between a path parameter (`/items/{item_id}`) and a query parameter (`?q=hello`)?
+3. Where does the interactive documentation at `/docs` come from? Did you write any HTML?
+4. What role does `uvicorn` play? Why can't you just run a FastAPI app with `python app.py` without it?
+
+## Mastery check
+
+You can move on when you can:
+
+- start the server and visit `/docs` without looking at these instructions,
+- add a new endpoint with both path and query parameters,
+- explain what uvicorn does and why FastAPI needs it,
+- describe how type hints control validation.
+
+## Next
+
+Continue to [02-crud-api](../02-crud-api/).

projects/modules/04-fastapi-web/01-hello-fastapi/app.py

@@ -0,0 +1,86 @@
+# ============================================================================
+# Project 01 — Hello FastAPI
+# ============================================================================
+# This is your first FastAPI application. It creates a web server with three
+# endpoints. FastAPI uses Python type hints and decorators to define routes,
+# validate inputs, and generate interactive documentation automatically.
+#
+# Run this file:
+#   python app.py
+#
+# Then visit:
+#   http://127.0.0.1:8000       — root endpoint
+#   http://127.0.0.1:8000/docs  — interactive API documentation (Swagger UI)
+# ============================================================================
+
+from fastapi import FastAPI
+
+# ----------------------------------------------------------------------------
+# Create the FastAPI application instance.
+# This object is the core of your API. You attach routes to it using
+# decorators like @app.get(), @app.post(), etc.
+# ----------------------------------------------------------------------------
+app = FastAPI()
+
+
+# ----------------------------------------------------------------------------
+# Route 1: GET /
+# The @app.get("/") decorator tells FastAPI: "When someone sends a GET request
+# to the root path (/), call this function and return its result as JSON."
+#
+# FastAPI automatically converts the returned dictionary to a JSON response.
+# ----------------------------------------------------------------------------
+@app.get("/")
+def read_root():
+    """Return a welcome message. This docstring appears in the /docs page."""
+    return {"message": "Hello, FastAPI!"}
+
+
+# ----------------------------------------------------------------------------
+# Route 2: GET /items/{item_id}
+# Curly braces in the path create a "path parameter." The value in the URL
+# gets passed to the function as an argument.
+#
+# item_id: int — the type hint tells FastAPI to validate that item_id is an
+# integer. If someone passes a string like /items/abc, FastAPI automatically
+# returns a 422 Unprocessable Entity error. You did not write that validation
+# logic; FastAPI inferred it from the type hint.
+#
+# q: str | None = None — this is a "query parameter." It is not in the path,
+# so FastAPI looks for it in the URL query string (e.g., /items/42?q=hello).
+# The default value of None makes it optional.
+# ----------------------------------------------------------------------------
+@app.get("/items/{item_id}")
+def read_item(item_id: int, q: str | None = None):
+    """Fetch an item by its ID, with an optional search query."""
+    return {"item_id": item_id, "q": q}
+
+
+# ----------------------------------------------------------------------------
+# Route 3: GET /health
+# Health check endpoints are standard in production APIs. Monitoring tools
+# ping this endpoint to verify the server is running. It returns a simple
+# status message.
+# ----------------------------------------------------------------------------
+@app.get("/health")
+def health_check():
+    """Health check endpoint for monitoring."""
+    return {"status": "healthy"}
+
+
+# ----------------------------------------------------------------------------
+# Run the server when this file is executed directly.
+#
+# uvicorn is an ASGI server — it listens for HTTP requests and forwards them
+# to your FastAPI app. Without uvicorn, your app is just a Python object that
+# nobody can reach over the network.
+#
+# host="127.0.0.1" — only accept connections from your own machine.
+# port=8000        — listen on port 8000.
+# reload=True      — restart the server automatically when you edit this file.
+#                    This is a development convenience. Never use reload=True
+#                    in production.
+# ----------------------------------------------------------------------------
+if __name__ == "__main__":
+    import uvicorn
+    uvicorn.run("app:app", host="127.0.0.1", port=8000, reload=True)

projects/modules/04-fastapi-web/01-hello-fastapi/notes.md

@@ -0,0 +1,10 @@
+# Notes — Hello FastAPI
+
+## What I learned
+
+
+## What confused me
+
+
+## What I want to explore next
+

projects/modules/04-fastapi-web/02-crud-api/README.md

@@ -0,0 +1,82 @@
+# Module 04 / Project 02 — CRUD API
+
+Home: [README](../../../../README.md)
+
+## Focus
+
+GET/POST/PUT/DELETE endpoints, Pydantic models for request validation, proper HTTP status codes.
+
+## Why this project exists
+
+Most web APIs revolve around four operations: Create, Read, Update, Delete (CRUD). This project builds a todo list API that demonstrates all four. You will learn how Pydantic models validate incoming data automatically, how to return the right HTTP status codes, and how to structure an API that follows REST conventions.
+
+## Run
+
+```bash
+cd projects/modules/04-fastapi-web/02-crud-api
+python app.py
+```
+
+Then open **http://127.0.0.1:8000/docs** to test every endpoint interactively.
+
+Press `Ctrl+C` to stop the server.
+
+## Expected output
+
+Using the `/docs` interface or `curl`:
+
+```bash
+# Create a todo
+curl -X POST http://127.0.0.1:8000/todos -H "Content-Type: application/json" -d '{"title": "Learn FastAPI"}'
+# Returns: {"id": 1, "title": "Learn FastAPI", "completed": false}  (status 201)
+
+# List all todos
+curl http://127.0.0.1:8000/todos
+# Returns: [{"id": 1, "title": "Learn FastAPI", "completed": false}]
+
+# Update a todo
+curl -X PUT http://127.0.0.1:8000/todos/1 -H "Content-Type: application/json" -d '{"title": "Learn FastAPI", "completed": true}'
+# Returns: {"id": 1, "title": "Learn FastAPI", "completed": true}
+
+# Delete a todo
+curl -X DELETE http://127.0.0.1:8000/todos/1
+# Returns: (empty, status 204)
+```
+
+## Alter it
+
+1. Add a `description` field (optional string) to the todo model. Make sure it appears in create, update, and response models.
+2. Add a `GET /todos?completed=true` query parameter that filters the list to only completed or only incomplete todos.
+3. Add a `PATCH /todos/{todo_id}` endpoint that allows partial updates (only the fields you send get changed).
+
+## Break it
+
+1. Send a POST request with an empty body (no JSON). What error does FastAPI return?
+2. Send a POST request where `title` is an integer instead of a string. Does Pydantic accept it? Why?
+3. Try to GET, PUT, or DELETE a todo with an ID that does not exist. What happens?
+
+## Fix it
+
+1. The empty body error (422) is correct — Pydantic requires the `title` field. No fix needed; understand why validation matters.
+2. Pydantic coerces the integer to a string by default. If you want strict validation, use `StrictStr` from pydantic. Try it and see how the behavior changes.
+3. The 404 response for missing IDs is already handled. If it is not, add a check that raises `HTTPException(status_code=404, detail="Todo not found")`.
+
+## Explain it
+
+1. What is the difference between `TodoCreate` (the request model) and `TodoResponse` (the response model)? Why use separate models?
+2. Why does the POST endpoint return status code 201 instead of 200?
+3. Why does the DELETE endpoint return status code 204 with no body?
+4. How does Pydantic validation work? Where do you define what fields are required vs. optional?
+
+## Mastery check
+
+You can move on when you can:
+
+- create all four CRUD endpoints from memory,
+- explain why separate request and response Pydantic models are a good practice,
+- intentionally trigger a 422 validation error and explain the response body,
+- describe what status codes 200, 201, 204, 404, and 422 mean.
+
+## Next
+
+Continue to [03-database-backed](../03-database-backed/).