Phase 2b: backend services, routes, and notification triggers

Attachments: multer-backed uploads with random-hex filenames,
streaming downloads with Content-Disposition, 25MB limit,
mimetype allowlist, audit entries, orphan cleanup on DB failure.

Full-text search: searchTicketIds + searchComments via raw SQL
ranked with ts_rank, composable filters via Prisma.sql/join,
hydrated with findMany and reordered via Map to preserve rank.

Pagination: listTicketsPaged returns {data,total,page,pageSize}
only when page/pageSize present (array response stays default,
so the Goddard n8n flow is unchanged).

Bulk actions: reassign/close/setSeverity/setStatus on POST /bulk,
writes one audit entry per ticket via createMany.

Analytics: summarize(window) runs 5 parallel groupBy + raw-SQL
queries for open-by-severity, status counts, queue load,
age buckets, percentile_cont median resolution hours.

CSV export streams matching tickets via res.write; saved views
CRUD with per-user ownership checks (403 cross-user, 404 missing).

Notifications: in-app Notification rows gated by prefs, email via
nodemailer (SMTP_HOST-gated, no-op when unset), outgoing webhooks
with HMAC-SHA256 signed POST and 3-retry exponential backoff.
Triggers wired into createTicket/updateTicket/addComment; mention
detection via parseMentions skips self-notify.

Infra: docker-compose uploads volume + SMTP env passthrough;
.env.example SMTP section.

43 server tests passing (attachment/webhook/notification/savedView
services covered; bulkAction covered in ticketService).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

server/src/index.ts

@@ -9,6 +9,13 @@ import authRoutes from './routes/auth';
 import ticketRoutes from './routes/tickets';
 import ctiRoutes from './routes/cti';
 import userRoutes from './routes/users';
+import attachmentRoutes from './routes/attachments';
+import searchRoutes from './routes/search';
+import analyticsRoutes from './routes/analytics';
+import exportRoutes from './routes/export';
+import savedViewRoutes from './routes/savedViews';
+import notificationRoutes from './routes/notifications';
+import webhookRoutes from './routes/webhooks';
 import { authenticate } from './middleware/auth';
 import { errorHandler } from './middleware/errorHandler';
 import { startAutoCloseJob } from './jobs/autoClose';
@@ -43,6 +50,13 @@ app.use('/api/auth', authRoutes);
 app.use('/api/tickets', authenticate, ticketRoutes);
 app.use('/api/cti', authenticate, ctiRoutes);
 app.use('/api/users', authenticate, userRoutes);
+app.use('/api', attachmentRoutes); // self-mounts authenticate inside
+app.use('/api/search', authenticate, searchRoutes);
+app.use('/api/analytics', authenticate, analyticsRoutes);
+app.use('/api/export', authenticate, exportRoutes);
+app.use('/api/saved-views', authenticate, savedViewRoutes);
+app.use('/api/notifications', authenticate, notificationRoutes);
+app.use('/api/webhooks', authenticate, webhookRoutes);
 
 app.use(errorHandler);