Phase 1a: shared schemas, service layer, server tooling

- shared/schemas/: move Zod schemas out of routes so client + server share them
- shared/types.ts: inferred types and enums for cross-package use
- server tsconfig rootDir raised to ".." so shared/ compiles in-tree
- server/src/services/: ticket, comment, cti, user, auth, notification (stub), search (stub)
- Routes thinned to validate-delegate-return; business logic now testable in isolation
- server/src/lib/httpError.ts: typed HttpError replaces ad-hoc throw shapes
- server/src/lib/logger.ts: pino structured logging replaces console.log
- autoClose job delegates to ticketService.closeStale()
- express-rate-limit on /api/auth/login (10 / 15min / IP)
- vitest + vitest-mock-extended; 20 service-level tests cover auth, ticket, comment, user flows
- CI: lint + test jobs before docker builds

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

server/src/routes/cti.ts

@@ -1,112 +1,74 @@
 import { Router } from 'express';
-import { z } from 'zod';
-import prisma from '../lib/prisma';
 import { requireAdmin } from '../middleware/auth';
+import {
+  ctiNameSchema as nameSchema,
+  createTypeSchema,
+  createItemSchema,
+} from '../../../shared/schemas/cti';
+import * as ctiService from '../services/ctiService';
 
 const router = Router();
 
-const nameSchema = z.object({ name: z.string().min(1).max(100) });
-
-// ── Categories ────────────────────────────────────────────────────────────────
+// ── Categories ───────────────────────────────────────────────────────────────
 
 router.get('/categories', async (_req, res) => {
-  const categories = await prisma.category.findMany({ orderBy: { name: 'asc' } });
-  res.json(categories);
+  res.json(await ctiService.listCategories());
 });
 
 router.post('/categories', requireAdmin, async (req, res) => {
   const { name } = nameSchema.parse(req.body);
-  const category = await prisma.category.create({ data: { name } });
-  res.status(201).json(category);
+  res.status(201).json(await ctiService.createCategory(name));
 });
 
 router.put('/categories/:id', requireAdmin, async (req, res) => {
   const { name } = nameSchema.parse(req.body);
-  const category = await prisma.category.update({
-    where: { id: req.params.id },
-    data: { name },
-  });
-  res.json(category);
+  res.json(await ctiService.updateCategory(req.params.id, name));
 });
 
 router.delete('/categories/:id', requireAdmin, async (req, res) => {
-  await prisma.category.delete({ where: { id: req.params.id } });
+  await ctiService.deleteCategory(req.params.id);
   res.status(204).send();
 });
 
-// ── Types ─────────────────────────────────────────────────────────────────────
+// ── Types ────────────────────────────────────────────────────────────────────
 
 router.get('/types', async (req, res) => {
-  const { categoryId } = req.query;
-  const types = await prisma.type.findMany({
-    where: categoryId ? { categoryId: categoryId as string } : undefined,
-    include: { category: true },
-    orderBy: { name: 'asc' },
-  });
-  res.json(types);
+  res.json(await ctiService.listTypes(req.query.categoryId as string | undefined));
 });
 
 router.post('/types', requireAdmin, async (req, res) => {
-  const { name, categoryId } = z
-    .object({ name: z.string().min(1).max(100), categoryId: z.string().min(1) })
-    .parse(req.body);
-  const type = await prisma.type.create({
-    data: { name, categoryId },
-    include: { category: true },
-  });
-  res.status(201).json(type);
+  const { name, categoryId } = createTypeSchema.parse(req.body);
+  res.status(201).json(await ctiService.createType(name, categoryId));
 });
 
 router.put('/types/:id', requireAdmin, async (req, res) => {
   const { name } = nameSchema.parse(req.body);
-  const type = await prisma.type.update({
-    where: { id: req.params.id },
-    data: { name },
-    include: { category: true },
-  });
-  res.json(type);
+  res.json(await ctiService.updateType(req.params.id, name));
 });
 
 router.delete('/types/:id', requireAdmin, async (req, res) => {
-  await prisma.type.delete({ where: { id: req.params.id } });
+  await ctiService.deleteType(req.params.id);
   res.status(204).send();
 });
 
-// ── Items ─────────────────────────────────────────────────────────────────────
+// ── Items ────────────────────────────────────────────────────────────────────
 
 router.get('/items', async (req, res) => {
-  const { typeId } = req.query;
-  const items = await prisma.item.findMany({
-    where: typeId ? { typeId: typeId as string } : undefined,
-    include: { type: { include: { category: true } } },
-    orderBy: { name: 'asc' },
-  });
-  res.json(items);
+  res.json(await ctiService.listItems(req.query.typeId as string | undefined));
 });
 
 router.post('/items', requireAdmin, async (req, res) => {
-  const { name, typeId } = z
-    .object({ name: z.string().min(1).max(100), typeId: z.string().min(1) })
-    .parse(req.body);
-  const item = await prisma.item.create({
-    data: { name, typeId },
-    include: { type: { include: { category: true } } },
-  });
-  res.status(201).json(item);
+  const { name, typeId } = createItemSchema.parse(req.body);
+  res.status(201).json(await ctiService.createItem(name, typeId));
 });
 
 router.put('/items/:id', requireAdmin, async (req, res) => {
   const { name } = nameSchema.parse(req.body);
-  const item = await prisma.item.update({
-    where: { id: req.params.id },
-    data: { name },
-    include: { type: { include: { category: true } } },
-  });
-  res.json(item);
+  res.json(await ctiService.updateItem(req.params.id, name));
 });
 
 router.delete('/items/:id', requireAdmin, async (req, res) => {
-  await prisma.item.delete({ where: { id: req.params.id } });
+  await ctiService.deleteItem(req.params.id);
   res.status(204).send();
 });