feat: establish auth listing and image vertical slices

Includes MFA-capable authentication, session and CSRF security, password recovery, listing lifecycle and ownership rules, inventory image metadata, local ImageStorage, migrations, tests, and implementation status documentation. Verification: npm test (62 passing) and integration suite (14 passing).

apps/api/src/modules/inventory/routes/admin-image-routes.js

@@ -0,0 +1,46 @@
+import { toAdminInventoryImageDto } from '@pokemon-inventory/contracts/image';
+import { createInventoryImageSchema } from '@pokemon-inventory/validation/image';
+
+import { createApplicationError } from '../../../shared/errors/application-error.js';
+
+function validationError(reply, result) {
+  return reply.code(400).send({
+    error: {
+      code: 'VALIDATION_ERROR',
+      message: 'Request validation failed.',
+      details: result.error.issues.map(({ message, path }) => ({ message, path })),
+    },
+  });
+}
+
+export async function registerAdminImageRoutes(app, options) {
+  const {
+    authenticateAdmin,
+    authorizeUnsafeRequest,
+    sessionCookieName = 'pokemon_inventory_session',
+    inventoryImageService,
+  } = options;
+
+  app.post('/inventory/:id/images', async (request, reply) => {
+    const admin = await authenticateAdmin(request);
+    if (!admin?.sellerId) {
+      throw createApplicationError('UNAUTHORIZED', 'Authentication is required.', 401);
+    }
+
+    await authorizeUnsafeRequest?.(
+      request.cookies[sessionCookieName],
+      request.headers['x-csrf-token'],
+    );
+
+    const result = createInventoryImageSchema.safeParse(request.body);
+    if (!result.success) return validationError(reply, result);
+
+    const image = await inventoryImageService.create({
+      ...result.data,
+      inventoryItemId: request.params.id,
+      sellerId: admin.sellerId,
+    });
+
+    return reply.code(201).send({ data: toAdminInventoryImageDto(image) });
+  });
+}