backend: org-scoped pharmacy inventory model

Add an `inventory` resource mirroring the prescriptions feature end-to-end:
Drizzle table (org-scoped, indexed), domain type, zod validation, service
(list/get/create/update/delete), and an RBAC-gated CRUD router mounted at
/api/inventory. Grant the new `inventory` statement to roles — pharmacy gets
read/write, full clinicians read/write/delete, reception/lab none — in both the
backend access control and (mirrored) the frontend. Record writes in the
activity log via a new `inventory` entity type. Includes the migration and an
idempotent demo seed script.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/inventory.ts

@@ -0,0 +1,102 @@
+import { Router } from "express";
+
+import { HttpError } from "../lib/http-error.js";
+import { inventoryInputSchema } from "../lib/inventory-validation.js";
+import {
+  requireAuth,
+  requireOrg,
+  requirePermission,
+} from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
+import * as service from "../services/inventory.js";
+
+export const inventoryRouter = Router();
+
+inventoryRouter.use(requireAuth, requireOrg);
+
+inventoryRouter.get(
+  "/",
+  requirePermission({ inventory: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json(await service.listInventory(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+inventoryRouter.post(
+  "/",
+  requirePermission({ inventory: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const input = inventoryInputSchema.parse(req.body);
+      const created = await service.createInventory(
+        req.organizationId!,
+        req.user!.id,
+        input,
+      );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Added ${created.name} to inventory`,
+        entityType: "inventory",
+        entityId: created.id,
+      });
+      res.status(201).json(created);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+inventoryRouter.put(
+  "/:id",
+  requirePermission({ inventory: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const input = inventoryInputSchema.parse(req.body);
+      const updated = await service.updateInventory(
+        req.organizationId!,
+        req.params.id as string,
+        input,
+      );
+      if (!updated) throw new HttpError(404, "Inventory item not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated inventory — ${updated.name}`,
+        entityType: "inventory",
+        entityId: updated.id,
+      });
+      res.json(updated);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+inventoryRouter.delete(
+  "/:id",
+  requirePermission({ inventory: ["delete"] }),
+  async (req, res, next) => {
+    try {
+      const ok = await service.deleteInventory(
+        req.organizationId!,
+        req.params.id as string,
+      );
+      if (!ok) throw new HttpError(404, "Inventory item not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted inventory item",
+        entityType: "inventory",
+        entityId: req.params.id as string,
+      });
+      res.status(204).end();
+    } catch (err) {
+      next(err);
+    }
+  },
+);