docs(14-04): complete route handlers async conversion plan

- Add 14-04-SUMMARY.md documenting async conversion of all 9 route files and auth middleware
- Update STATE.md with progress (83%) and decisions
- Update ROADMAP.md with plan progress

.planning/phases/14-postgresql-migration/14-04-SUMMARY.md

@@ -0,0 +1,111 @@
+---
+phase: 14-postgresql-migration
+plan: 04
+subsystem: api
+tags: [hono, async-await, routes, middleware, drizzle]
+
+# Dependency graph
+requires:
+  - phase: 14-03
+    provides: Async service functions that return Promises
+provides:
+  - "All route handlers properly await async service calls"
+  - "Auth middleware awaits DB queries for session/API key validation"
+  - "Settings route uses async direct DB calls (no .get()/.run()/.all())"
+affects: [14-05, 14-06]
+
+# Tech tracking
+tech-stack:
+  added: []
+  patterns: [async route handlers, await service calls, destructured single-row DB results]
+
+key-files:
+  created: []
+  modified:
+    - src/server/routes/items.ts
+    - src/server/routes/categories.ts
+    - src/server/routes/threads.ts
+    - src/server/routes/setups.ts
+    - src/server/routes/totals.ts
+    - src/server/routes/auth.ts
+    - src/server/routes/oauth.ts
+    - src/server/routes/settings.ts
+    - src/server/middleware/auth.ts
+
+key-decisions:
+  - "Settings route .get() replaced with destructuring: const [row] = await db.select()..."
+  - "Auth route direct DB query for user record converted same way"
+
+patterns-established:
+  - "Route handler pattern: async (c) => { const result = await serviceFunction(db, ...); }"
+  - "Direct DB queries in routes: const [row] = await db.select().from(table).where(...)"
+
+requirements-completed: [DB-01, DB-02]
+
+# Metrics
+duration: 6min
+completed: 2026-04-04
+---
+
+# Phase 14 Plan 04: Route Handlers Async Conversion Summary
+
+**All 9 route files and auth middleware converted to properly await async service/DB calls, preventing Promise-as-JSON responses**
+
+## Performance
+
+- **Duration:** 6 min
+- **Started:** 2026-04-04T10:37:05Z
+- **Completed:** 2026-04-04T10:43:53Z
+- **Tasks:** 2
+- **Files modified:** 9
+
+## Accomplishments
+- Converted all data route handlers (items, categories, threads, setups, totals) to async with awaited service calls
+- Converted auth, OAuth, settings routes and auth middleware to async with awaited service/DB calls
+- Removed all synchronous SQLite API patterns (.get(), .run(), .all()) from settings route and auth route direct DB queries
+
+## Task Commits
+
+Each task was committed atomically:
+
+1. **Task 1: Convert data route handlers to async** - `5edcc66` (feat)
+2. **Task 2: Convert auth, OAuth, settings, images routes and auth middleware** - `22aaed7` (feat)
+
+## Files Created/Modified
+- `src/server/routes/items.ts` - All 8 handlers now async with awaited service calls
+- `src/server/routes/categories.ts` - All 4 handlers now async with awaited service calls
+- `src/server/routes/threads.ts` - All 11 handlers now async with awaited service calls
+- `src/server/routes/setups.ts` - All 8 handlers now async with awaited service calls
+- `src/server/routes/totals.ts` - Handler now async with awaited service calls
+- `src/server/routes/auth.ts` - All 7 handlers now async; direct DB query converted to destructuring
+- `src/server/routes/oauth.ts` - All OAuth service calls now awaited
+- `src/server/routes/settings.ts` - Direct DB calls converted: .get() -> destructuring, .run() removed, await added
+- `src/server/middleware/auth.ts` - getUserCount, getSession, refreshSession all awaited
+
+## Decisions Made
+- Settings route direct DB queries converted using same pattern as services: `const [row] = await db.select()...` instead of `.get()`
+- Auth route direct user lookup converted identically
+- Images route already had all calls properly awaited (fetchImageFromUrl was already async), no changes needed
+
+## Deviations from Plan
+
+None - plan executed exactly as written.
+
+## Issues Encountered
+- Biome formatting error in threads.ts after adding `async` keyword made line too long - reformatted to multi-line function call pattern
+
+## User Setup Required
+
+None - no external service configuration required.
+
+## Next Phase Readiness
+- All route handlers and middleware now async-compatible with PGlite/Postgres async drivers
+- Ready for Plan 05 (data migration) and Plan 06 (test migration)
+
+## Self-Check: PASSED
+
+All 9 modified files confirmed present. Both task commits (5edcc66, 22aaed7) verified in git log.
+
+---
+*Phase: 14-postgresql-migration*
+*Completed: 2026-04-04*