feat(01-02): add Hono API routes with validation, image upload, and integration tests

- Item routes: GET, POST, PUT, DELETE with Zod validation and image cleanup
- Category routes: GET, POST, PUT, DELETE with Uncategorized protection
- Totals route: per-category and global aggregates
- Image upload: multipart file handling with type/size validation
- Routes use DI via Hono context variables for testability
- Integration tests: 10 tests covering all endpoints and edge cases
- All 30 tests passing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/routes/items.ts

@@ -0,0 +1,66 @@
+import { Hono } from "hono";
+import { zValidator } from "@hono/zod-validator";
+import { createItemSchema, updateItemSchema } from "../../shared/schemas.ts";
+import {
+  getAllItems,
+  getItemById,
+  createItem,
+  updateItem,
+  deleteItem,
+} from "../services/item.service.ts";
+import { unlink } from "node:fs/promises";
+import { join } from "node:path";
+
+type Env = { Variables: { db?: any } };
+
+const app = new Hono<Env>();
+
+app.get("/", (c) => {
+  const db = c.get("db");
+  const items = getAllItems(db);
+  return c.json(items);
+});
+
+app.get("/:id", (c) => {
+  const db = c.get("db");
+  const id = Number(c.req.param("id"));
+  const item = getItemById(db, id);
+  if (!item) return c.json({ error: "Item not found" }, 404);
+  return c.json(item);
+});
+
+app.post("/", zValidator("json", createItemSchema), (c) => {
+  const db = c.get("db");
+  const data = c.req.valid("json");
+  const item = createItem(db, data);
+  return c.json(item, 201);
+});
+
+app.put("/:id", zValidator("json", updateItemSchema.omit({ id: true })), (c) => {
+  const db = c.get("db");
+  const id = Number(c.req.param("id"));
+  const data = c.req.valid("json");
+  const item = updateItem(db, id, data);
+  if (!item) return c.json({ error: "Item not found" }, 404);
+  return c.json(item);
+});
+
+app.delete("/:id", async (c) => {
+  const db = c.get("db");
+  const id = Number(c.req.param("id"));
+  const deleted = deleteItem(db, id);
+  if (!deleted) return c.json({ error: "Item not found" }, 404);
+
+  // Clean up image file if exists
+  if (deleted.imageFilename) {
+    try {
+      await unlink(join("uploads", deleted.imageFilename));
+    } catch {
+      // File missing is not an error worth failing the delete over
+    }
+  }
+
+  return c.json({ success: true });
+});
+
+export { app as itemRoutes };