feat: add admin inventory CSV export

apps/api/tests/application/admin-export-service.test.js

@@ -31,3 +31,24 @@ test('exports seller inventory through the admin DTO boundary', async () => {
     updatedAt: '2026-09-10T00:00:00.000Z',
   }]);
 });
+
+test('exports inventory as escaped CSV rows', async () => {
+  const service = createAdminExportService({
+    inventoryItemService: {
+      async listBySellerId() {
+        return [{
+          id: 'item-1',
+          productId: 'product-1',
+          conditionId: 'condition-1',
+          status: 'ACTIVE',
+          notes: 'Front, "clean"\nback',
+        }];
+      },
+    },
+  });
+
+  assert.equal(await service.inventoryCsv({ sellerId: 'seller-1' }), [
+    'id,productId,conditionId,status,notes,createdAt,updatedAt',
+    '"item-1","product-1","condition-1","ACTIVE","Front, ""clean""\nback","",""',
+  ].join('\r\n'));
+});

apps/api/tests/http/admin-export-routes.test.js

@@ -57,3 +57,26 @@ test('requires authentication for inventory JSON exports', async (testContext) =
   assert.equal(response.statusCode, 401);
   assert.equal(response.json().error.code, 'UNAUTHORIZED');
 });
+
+test('downloads seller-scoped inventory CSV for an authenticated admin', async (testContext) => {
+  const app = buildApp({
+    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
+    adminExportService: {
+      async inventoryCsv({ sellerId }) {
+        assert.equal(sellerId, 'seller-1');
+        return 'id,status\r\n"item-1","ACTIVE"';
+      },
+    },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'GET',
+    url: '/api/v1/admin/exports/inventory.csv',
+  });
+
+  assert.equal(response.statusCode, 200);
+  assert.equal(response.headers['content-type'], 'text/csv; charset=utf-8');
+  assert.equal(response.headers['content-disposition'], 'attachment; filename="inventory.csv"');
+  assert.equal(response.body, 'id,status\r\n"item-1","ACTIVE"');
+});