feat: complete inventory image and sales workflows

Commit the working vertical slices for inventory image processing and the Sale workflow, including Sale history, audited voiding, multi-item persistence, admin UI, migrations, documentation, and tests.

apps/api/tests/http/sale-routes.test.js

@@ -0,0 +1,118 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+const saleResult = {
+  sale: {
+    id: 'sale-1',
+    sellerId: 'seller-1',
+    saleDate: '2026-09-09',
+    soldPriceMinor: 2499,
+    currency: 'USD',
+    platformFeesMinor: 0,
+    paymentProcessingFeesMinor: 0,
+    shippingCostMinor: 0,
+    taxesMinor: 0,
+    otherFeesMinor: 0,
+  },
+  saleItem: {
+    id: 'sale-item-1',
+    inventoryItemId: 'inventory-1',
+    soldPriceMinor: 2499,
+    costBasisMinor: 1200,
+  },
+  inventoryItem: { id: 'inventory-1', status: 'SOLD' },
+};
+
+function createTestApp({ authenticateAdmin, authorizeUnsafeRequest } = {}) {
+  return buildApp({
+    authenticateAdmin,
+    authorizeUnsafeRequest,
+    saleService: {
+      async create(input) {
+        assert.equal(input.sellerId, 'seller-1');
+        return saleResult;
+      },
+    },
+  });
+}
+
+test('creates a sale for the authenticated seller with CSRF protection', async (testContext) => {
+  let csrfChecks = 0;
+  const app = createTestApp({
+    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
+    authorizeUnsafeRequest: async () => { csrfChecks += 1; },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/sales',
+    headers: { 'x-csrf-token': 'csrf-token' },
+    payload: {
+      inventoryItemId: 'd2f67d74-9647-48d5-b3a4-74d3b16ea9f8',
+      costBasisMinor: 1200,
+      saleDate: '2026-09-09',
+      soldPriceMinor: 2499,
+    },
+  });
+
+  assert.equal(response.statusCode, 201);
+  assert.equal(response.json().data.inventoryItem.status, 'SOLD');
+  assert.equal(csrfChecks, 1);
+});
+
+test('rejects invalid sale requests and unauthenticated requests', async (testContext) => {
+  const app = createTestApp({ authenticateAdmin: async () => ({ sellerId: 'seller-1' }) });
+  testContext.after(() => app.close());
+
+  const invalidResponse = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/sales',
+    payload: {
+      inventoryItemId: 'not-a-uuid',
+      costBasisMinor: -1,
+      saleDate: 'tomorrow',
+      soldPriceMinor: 0,
+    },
+  });
+  assert.equal(invalidResponse.statusCode, 400);
+  assert.equal(invalidResponse.json().error.code, 'VALIDATION_ERROR');
+
+  const unauthenticatedApp = createTestApp();
+  testContext.after(() => unauthenticatedApp.close());
+  const unauthenticatedResponse = await unauthenticatedApp.inject({
+    method: 'POST',
+    url: '/api/v1/admin/sales',
+    payload: {},
+  });
+  assert.equal(unauthenticatedResponse.statusCode, 401);
+  assert.equal(unauthenticatedResponse.json().error.code, 'UNAUTHORIZED');
+});
+
+test('voids a sale with CSRF protection and actor identity', async (testContext) => {
+  let voidInput;
+  const app = buildApp({
+    authenticateAdmin: async () => ({ userId: 'user-1', sellerId: 'seller-1' }),
+    authorizeUnsafeRequest: async () => {},
+    saleService: {
+      async void(input) {
+        voidInput = input;
+        return saleResult;
+      },
+    },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/sales/sale-1/void',
+    headers: { 'x-csrf-token': 'csrf-token' },
+    payload: { reason: 'Duplicate entry' },
+  });
+
+  assert.equal(response.statusCode, 200);
+  assert.equal(voidInput.actorUserId, 'user-1');
+  assert.equal(response.json().data.inventoryItem.status, 'SOLD');
+});