feat: add public product catalog boundary

apps/api/tests/http/public-product-routes.test.js

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+function createTestApp() {
+  return buildApp({
+    publicProductService: {
+      async getBySlug(slug) {
+        if (slug !== 'pikachu-plush') {
+          const error = new Error('Product was not found.');
+          error.code = 'PRODUCT_NOT_FOUND';
+          error.statusCode = 404;
+          throw error;
+        }
+
+        return {
+          id: 'product-1',
+          sellerId: 'private-seller-id',
+          categoryId: 'category-1',
+          name: 'Pikachu Plush',
+          slug,
+          description: 'A friendly plush.',
+          createdAt: new Date('2026-09-07T00:00:00.000Z'),
+          updatedAt: new Date('2026-09-07T00:00:00.000Z'),
+        };
+      },
+    },
+  });
+}
+
+test('returns a public product without private seller identity', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/products/pikachu-plush',
+  });
+
+  assert.equal(response.statusCode, 200);
+  assert.deepEqual(response.json().data, {
+    id: 'product-1',
+    categoryId: 'category-1',
+    name: 'Pikachu Plush',
+    slug: 'pikachu-plush',
+    description: 'A friendly plush.',
+    brand: null,
+    setName: null,
+    cardNumber: null,
+    eventName: null,
+    releaseYear: null,
+    createdAt: '2026-09-07T00:00:00.000Z',
+    updatedAt: '2026-09-07T00:00:00.000Z',
+  });
+  assert.equal('sellerId' in response.json().data, false);
+});
+
+test('returns not found when a product is not publicly visible', async (testContext) => {
+  const app = createTestApp();
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/public/products/hidden-product',
+  });
+
+  assert.equal(response.statusCode, 404);
+  assert.equal(response.json().error.code, 'PRODUCT_NOT_FOUND');
+});