feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

apps/api/src/app/build-app.js

@@ -0,0 +1,53 @@
+import Fastify from 'fastify';
+import cookie from '@fastify/cookie';
+
+import { registerAuthRoutes } from '../modules/auth/routes/auth-routes.js';
+import { registerAdminInventoryRoutes } from '../modules/inventory/routes/admin-inventory-routes.js';
+import { registerAdminImageRoutes } from '../modules/inventory/routes/admin-image-routes.js';
+import { registerAdminListingRoutes } from '../modules/listings/routes/admin-listing-routes.js';
+import { registerAdminProductRoutes } from '../modules/products/routes/admin-product-routes.js';
+
+export function buildApp(dependencies) {
+  const app = Fastify();
+
+  app.setErrorHandler((error, request, reply) => {
+    const statusCode = error.statusCode ?? 500;
+    const message = statusCode >= 500 ? 'Internal server error.' : error.message;
+
+    if (statusCode >= 500) {
+      request.log.error(error);
+    }
+
+    return reply.code(statusCode).send({
+      error: {
+        code: error.code ?? 'INTERNAL_SERVER_ERROR',
+        message,
+      },
+    });
+  });
+
+  app.get('/health', async () => ({ data: { status: 'ok' } }));
+  app.register(cookie);
+  app.register(registerAuthRoutes, {
+    ...dependencies,
+    prefix: '/api/v1/auth',
+  });
+  app.register(registerAdminProductRoutes, {
+    ...dependencies,
+    prefix: '/api/v1/admin',
+  });
+  app.register(registerAdminInventoryRoutes, {
+    ...dependencies,
+    prefix: '/api/v1/admin',
+  });
+  app.register(registerAdminImageRoutes, {
+    ...dependencies,
+    prefix: '/api/v1/admin',
+  });
+  app.register(registerAdminListingRoutes, {
+    ...dependencies,
+    prefix: '/api/v1/admin',
+  });
+
+  return app;
+}