feat(18-03): add profile routes, public setup endpoint, and auth middleware updates

- GET /api/users/:id/profile: public profile with public setups (no auth)
- PUT /api/auth/profile: update own profile (requires auth)
- GET /api/setups/:id/public: public setup view with items (no auth)
- Auth middleware skips public profile and public setup GET endpoints
- Register profileRoutes at /api/users in index.ts
- Add getOrCreateUncategorized to category service (Rule 3 fix)
- 10 route tests covering auth, public access, and 404 cases

src/server/services/category.service.ts

@@ -1,9 +1,25 @@
-import { asc, eq } from "drizzle-orm";
+import { and, asc, eq } from "drizzle-orm";
 import { db as prodDb } from "../../db/index.ts";
 import { categories, items } from "../../db/schema.ts";
 
 type Db = typeof prodDb;
 
+export async function getOrCreateUncategorized(db: Db, userId: number) {
+	const [existing] = await db
+		.select()
+		.from(categories)
+		.where(
+			and(eq(categories.userId, userId), eq(categories.name, "Uncategorized")),
+		);
+	if (existing) return existing;
+
+	const [created] = await db
+		.insert(categories)
+		.values({ name: "Uncategorized", icon: "package", userId })
+		.returning();
+	return created;
+}
+
 export function getAllCategories(db: Db = prodDb) {
 	return db.select().from(categories).orderBy(asc(categories.name)).all();
 }