feat: add seller-scoped bulk archive

Add the first bulk inventory operation through a validated, CSRF-protected API route with lifecycle and ownership enforcement, tests, and implementation-status documentation.

apps/api/tests/http/admin-product-routes.test.js

@@ -7,6 +7,7 @@ import { createProductService } from '../../src/modules/products/services/produc
 
 function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
   const products = [];
+  const inventoryItems = [];
   const productRepository = {
     async create(product) {
       const createdProduct = {
@@ -49,13 +50,24 @@ function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
       },
       inventoryItemRepository: {
         async create(inventoryItem) {
-          return {
-            id: 'inventory-1',
+          const createdItem = {
+            id: '8a0a836a-a597-454d-8c5e-e146d27dbbf2',
             ...inventoryItem,
             status: 'ACTIVE',
             createdAt: new Date('2026-09-07T00:00:00.000Z'),
             updatedAt: new Date('2026-09-07T00:00:00.000Z'),
           };
+          inventoryItems.push(createdItem);
+          return createdItem;
+        },
+        async listBySellerId() {
+          return inventoryItems;
+        },
+        async archiveByIdsForSeller(ids) {
+          return inventoryItems.filter(({ id }) => ids.includes(id)).map((item) => {
+            item.status = 'ARCHIVED';
+            return item;
+          });
         },
       },
     }),
@@ -146,6 +158,41 @@ test('creates inventory only for the authenticated sellers product', async (test
   assert.equal(response.json().data.status, 'ACTIVE');
 });
 
+test('archives selected inventory through the authenticated bulk route', async (testContext) => {
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),
+  });
+  testContext.after(() => app.close());
+
+  const productResponse = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/products',
+    payload: {
+      name: 'Pikachu Plush',
+      categoryId: 'ab8150c7-96c1-4b55-8d69-7d0b77d48958',
+    },
+  });
+  await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/inventory',
+    payload: {
+      productId: productResponse.json().data.id,
+      conditionId: '21eb218b-7a95-4f80-a9e3-e306f7ca1f2e',
+    },
+  });
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/bulk',
+    payload: {
+      action: 'ARCHIVE',
+      inventoryItemIds: ['8a0a836a-a597-454d-8c5e-e146d27dbbf2'],
+    },
+  });
+
+  assert.equal(response.statusCode, 200);
+  assert.equal(response.json().data[0].status, 'ARCHIVED');
+});
+
 test('rejects an authenticated product write without a CSRF token', async (testContext) => {
   const app = createTestApp({
     authenticateAdmin: async () => ({ sellerId: 'b078adf4-6a91-4b3d-a263-740246c11e3f' }),