feat: implement backend API for Pantree Phase 1 MVP

- Project setup: package.json, tsconfig.json, jest.config.js, .env.example
- Config: env.ts, constants.ts (ALLOWED_UNITS, bcrypt rounds, JWT, deletion windows)
- DB: Knex connection, knexfile, migrations 001-006 (users, password_reset_tokens,
  pantry_items, recipes+recipe_ingredients, shopping_lists+items, deleted_records)
- Seeds: 10 seeded recipes with full ingredient lists
- Middleware: JWT authMiddleware (validates token + user existence), errorHandler
- Utils: Pino logger, JWT sign helper, Zod validators for all request shapes
- Services: authService (signup/signin/google/pwd-reset/soft-delete/restore),
  pantryService (CRUD + case-insensitive duplicate guard),
  recipeService (browse+filter+scale), shoppingListService (CRUD+merge logic),
  syncService (delta sync + tombstone cleanup), emailService (SendGrid)
- Routes: /v1/auth, /v1/pantry, /v1/recipes, /v1/shopping-lists, /v1/sync
- App: Express factory (createApp), server entry point
- Jobs: node-cron daily hard-delete + tombstone cleanup
- Tests: validators, utils, auth, pantry, recipes, shopping lists, sync

src/routes/auth.ts

@@ -0,0 +1,134 @@
+import { Router, Response, NextFunction } from 'express';
+import { authService } from '../services/authService';
+import { AuthenticatedRequest, authMiddleware } from '../middleware/auth';
+import {
+  signupSchema,
+  signinSchema,
+  googleAuthSchema,
+  passwordResetRequestSchema,
+  passwordResetConfirmSchema,
+} from '../utils/validators';
+
+const router = Router();
+
+// POST /auth/signup
+router.post('/signup', async (req, res: Response, next: NextFunction) => {
+  try {
+    const { email, password, name } = signupSchema.parse(req.body);
+    const result = await authService.signup(email, password, name);
+    res.status(201).json(result);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /auth/signin
+router.post('/signin', async (req, res: Response, next: NextFunction) => {
+  try {
+    const { email, password } = signinSchema.parse(req.body);
+    const result = await authService.signin(email, password);
+    res.status(200).json(result);
+  } catch (err: unknown) {
+    if (
+      err instanceof Error &&
+      (err as { code?: string }).code === 'ACCOUNT_PENDING_DELETION'
+    ) {
+      const appErr = err as { code?: string; statusCode?: number; deletion_scheduled_at?: string };
+      res.status(403).json({
+        error: err.message,
+        code: appErr.code,
+        deletion_scheduled_at: appErr.deletion_scheduled_at,
+        timestamp: new Date().toISOString(),
+      });
+      return;
+    }
+    next(err);
+  }
+});
+
+// POST /auth/google
+router.post('/google', async (req, res: Response, next: NextFunction) => {
+  try {
+    const { id_token } = googleAuthSchema.parse(req.body);
+    const result = await authService.googleAuth(id_token);
+    const statusCode = result.is_new_user ? 201 : 200;
+    res.status(statusCode).json(result);
+  } catch (err: unknown) {
+    if (
+      err instanceof Error &&
+      (err as { code?: string }).code === 'ACCOUNT_PENDING_DELETION'
+    ) {
+      const appErr = err as { code?: string; statusCode?: number; deletion_scheduled_at?: string };
+      res.status(403).json({
+        error: err.message,
+        code: appErr.code,
+        deletion_scheduled_at: appErr.deletion_scheduled_at,
+        timestamp: new Date().toISOString(),
+      });
+      return;
+    }
+    next(err);
+  }
+});
+
+// POST /auth/password-reset
+router.post('/password-reset', async (req, res: Response, next: NextFunction) => {
+  try {
+    const { email } = passwordResetRequestSchema.parse(req.body);
+    await authService.requestPasswordReset(email);
+    res.status(200).json({
+      message: 'If an account exists with this email, a reset link has been sent.',
+      timestamp: new Date().toISOString(),
+    });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// PUT /auth/password-reset
+router.put('/password-reset', async (req, res: Response, next: NextFunction) => {
+  try {
+    const { token, new_password } = passwordResetConfirmSchema.parse(req.body);
+    await authService.confirmPasswordReset(token, new_password);
+    res.status(200).json({
+      message: 'Password updated successfully.',
+      timestamp: new Date().toISOString(),
+    });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// DELETE /auth/account (protected)
+router.delete(
+  '/account',
+  authMiddleware,
+  async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+    try {
+      await authService.deleteAccount(req.userId!);
+      res.status(204).send();
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+// POST /auth/restore-account (protected)
+router.post(
+  '/restore-account',
+  authMiddleware,
+  async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+    try {
+      const user = await authService.restoreAccount(req.userId!);
+      res.status(200).json({
+        user,
+        message: 'Account restored successfully.',
+        timestamp: new Date().toISOString(),
+      });
+    } catch (err) {
+      next(err);
+    }
+  }
+);
+
+export default router;

src/routes/pantry.ts

@@ -0,0 +1,51 @@
+import { Router, Response, NextFunction } from 'express';
+import { authMiddleware, AuthenticatedRequest } from '../middleware/auth';
+import { pantryService } from '../services/pantryService';
+import { addPantryItemSchema, updatePantryItemSchema } from '../utils/validators';
+
+const router = Router();
+router.use(authMiddleware);
+
+// GET /pantry
+router.get('/', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const items = await pantryService.getItems(req.userId!);
+    res.status(200).json({ items, synced_at: new Date().toISOString() });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /pantry
+router.post('/', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { item_name, quantity } = addPantryItemSchema.parse(req.body);
+    const item = await pantryService.addItem(req.userId!, item_name, quantity);
+    res.status(201).json({ item, synced_at: new Date().toISOString() });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// PUT /pantry/:item_id
+router.put('/:item_id', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { quantity } = updatePantryItemSchema.parse(req.body);
+    const item = await pantryService.updateItem(req.userId!, req.params.item_id, quantity);
+    res.status(200).json({ item, synced_at: new Date().toISOString() });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// DELETE /pantry/:item_id
+router.delete('/:item_id', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    await pantryService.deleteItem(req.userId!, req.params.item_id);
+    res.status(204).send();
+  } catch (err) {
+    next(err);
+  }
+});
+
+export default router;

src/routes/recipes.ts

@@ -0,0 +1,31 @@
+import { Router, Response, NextFunction } from 'express';
+import { authMiddleware, AuthenticatedRequest } from '../middleware/auth';
+import { recipeService } from '../services/recipeService';
+import { recipeQuerySchema, recipeDetailQuerySchema } from '../utils/validators';
+
+const router = Router();
+router.use(authMiddleware);
+
+// GET /recipes
+router.get('/', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { filter, page, limit, search } = recipeQuerySchema.parse(req.query);
+    const result = await recipeService.getRecipes(req.userId!, filter, page, limit, search);
+    res.status(200).json({ ...result, synced_at: new Date().toISOString() });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// GET /recipes/:recipe_id
+router.get('/:recipe_id', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { scale } = recipeDetailQuerySchema.parse(req.query);
+    const recipe = await recipeService.getRecipeById(req.params.recipe_id, req.userId!, scale);
+    res.status(200).json({ recipe });
+  } catch (err) {
+    next(err);
+  }
+});
+
+export default router;

src/routes/shoppingLists.ts

@@ -0,0 +1,118 @@
+import { Router, Response, NextFunction } from 'express';
+import { authMiddleware, AuthenticatedRequest } from '../middleware/auth';
+import { shoppingListService } from '../services/shoppingListService';
+import {
+  createShoppingListSchema,
+  addShoppingListItemSchema,
+  updateShoppingListItemSchema,
+  addRecipesToListSchema,
+} from '../utils/validators';
+
+const router = Router();
+router.use(authMiddleware);
+
+// GET /shopping-lists
+router.get('/', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const lists = await shoppingListService.getLists(req.userId!);
+    res.status(200).json({ shopping_lists: lists, synced_at: new Date().toISOString() });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /shopping-lists
+router.post('/', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { list_name } = createShoppingListSchema.parse(req.body);
+    const list = await shoppingListService.createList(req.userId!, list_name);
+    res.status(201).json({ shopping_list: list });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// GET /shopping-lists/:list_id
+router.get('/:list_id', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const list = await shoppingListService.getListById(req.params.list_id, req.userId!);
+    res.status(200).json({ shopping_list: list, synced_at: new Date().toISOString() });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// DELETE /shopping-lists/:list_id
+router.delete('/:list_id', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    await shoppingListService.deleteList(req.params.list_id, req.userId!);
+    res.status(204).send();
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /shopping-lists/:list_id/items
+router.post('/:list_id/items', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { item_name, quantity, unit } = addShoppingListItemSchema.parse(req.body);
+    const result = await shoppingListService.addItem(
+      req.params.list_id,
+      req.userId!,
+      item_name,
+      quantity,
+      unit
+    );
+    res.status(201).json(result);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// POST /shopping-lists/:list_id/add-recipes
+router.post('/:list_id/add-recipes', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { recipe_ids, scale_factor } = addRecipesToListSchema.parse(req.body);
+    const result = await shoppingListService.addRecipesToList(
+      req.params.list_id,
+      req.userId!,
+      recipe_ids,
+      scale_factor
+    );
+    res.status(201).json(result);
+  } catch (err) {
+    next(err);
+  }
+});
+
+// PUT /shopping-lists/:list_id/items/:item_id
+router.put('/:list_id/items/:item_id', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const updates = updateShoppingListItemSchema.parse(req.body);
+    const item = await shoppingListService.updateItem(
+      req.params.list_id,
+      req.params.item_id,
+      req.userId!,
+      updates
+    );
+    res.status(200).json({ item, synced_at: new Date().toISOString() });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// DELETE /shopping-lists/:list_id/items/:item_id
+router.delete('/:list_id/items/:item_id', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    await shoppingListService.deleteItem(
+      req.params.list_id,
+      req.params.item_id,
+      req.userId!
+    );
+    res.status(204).send();
+  } catch (err) {
+    next(err);
+  }
+});
+
+export default router;

src/routes/sync.ts

@@ -0,0 +1,20 @@
+import { Router, Response, NextFunction } from 'express';
+import { authMiddleware, AuthenticatedRequest } from '../middleware/auth';
+import { syncService } from '../services/syncService';
+import { syncQuerySchema } from '../utils/validators';
+
+const router = Router();
+router.use(authMiddleware);
+
+// GET /sync
+router.get('/', async (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+  try {
+    const { since } = syncQuerySchema.parse(req.query);
+    const delta = await syncService.getDelta(req.userId!, since);
+    res.status(200).json(delta);
+  } catch (err) {
+    next(err);
+  }
+});
+
+export default router;