feat: complete inventory image and sales workflows

Commit the working vertical slices for inventory image processing and the Sale workflow, including Sale history, audited voiding, multi-item persistence, admin UI, migrations, documentation, and tests.

apps/web/src/services/admin-image-service.js

@@ -55,6 +55,25 @@ export function deleteImage(imageId, csrfToken) {
   });
 }
 
+export async function uploadAdminImage(inventoryItemId, file, fields, csrfToken) {
+  const formData = new FormData();
+  formData.append('file', file);
+  formData.append('width', String(fields.width));
+  formData.append('height', String(fields.height));
+  formData.append('altText', fields.altText ?? '');
+  formData.append('isPrimary', String(fields.isPrimary ?? false));
+
+  const response = await fetch(`${apiBaseUrl}/admin/inventory/${encodeURIComponent(inventoryItemId)}/images`, {
+    method: 'POST',
+    credentials: 'include',
+    headers: { 'x-csrf-token': csrfToken },
+    body: formData,
+  });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(payload?.error?.message ?? 'Image upload is unavailable.');
+  return payload?.data;
+}
+
 export async function listAdminImages(inventoryItemId) {
   return request(`/admin/inventory/${encodeURIComponent(inventoryItemId)}/images`, {
     method: 'GET',

apps/web/src/services/admin-listing-service.js

@@ -1,7 +1,8 @@
 const apiBaseUrl = import.meta.env?.VITE_API_BASE_URL ?? '/api/v1';
 
 async function request(path, options = {}) {
-  const response = await fetch(`${apiBaseUrl}${path}`, { credentials: 'include', ...options, headers: { 'content-type': 'application/json', ...options.headers } });
+  const headers = { ...(options.body ? { 'content-type': 'application/json' } : {}), ...options.headers };
+  const response = await fetch(`${apiBaseUrl}${path}`, { credentials: 'include', ...options, headers });
   const payload = await response.json().catch(() => null);
   if (!response.ok) throw new Error(payload?.error?.message ?? 'Listing request failed.');
   return payload?.data;

apps/web/src/services/admin-sale-service.js

@@ -0,0 +1,38 @@
+const apiBaseUrl = import.meta.env?.VITE_API_BASE_URL ?? '/api/v1';
+
+export async function createAdminSale(input, csrfToken) {
+  const response = await fetch(`${apiBaseUrl}/admin/sales`, {
+    method: 'POST',
+    credentials: 'include',
+    headers: {
+      'content-type': 'application/json',
+      'x-csrf-token': csrfToken,
+    },
+    body: JSON.stringify(input),
+  });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(payload?.error?.message ?? 'Sale request failed.');
+  return payload?.data;
+}
+
+export async function listAdminSales() {
+  const response = await fetch(`${apiBaseUrl}/admin/sales`, { credentials: 'include' });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(payload?.error?.message ?? 'Sale history is unavailable.');
+  return payload?.data ?? [];
+}
+
+export async function voidAdminSale(id, reason, csrfToken) {
+  const response = await fetch(`${apiBaseUrl}/admin/sales/${encodeURIComponent(id)}/void`, {
+    method: 'POST',
+    credentials: 'include',
+    headers: {
+      'content-type': 'application/json',
+      'x-csrf-token': csrfToken,
+    },
+    body: JSON.stringify({ reason }),
+  });
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) throw new Error(payload?.error?.message ?? 'Sale correction failed.');
+  return payload?.data;
+}