feat: org-scoped prescriptions backend, wire prescriptions page

Add the prescriptions table, validation, service and CRUD routes
(/api/prescriptions, RBAC-gated; prescriber defaults to the signed-in
clinician, prescribedAt to today) and the frontend data module. The page
now loads/persists real data and computes its status KPIs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/prescriptions.ts

@@ -0,0 +1,83 @@
+import { Router } from "express";
+
+import { HttpError } from "../lib/http-error.js";
+import { prescriptionInputSchema } from "../lib/prescription-validation.js";
+import {
+  requireAuth,
+  requireOrg,
+  requirePermission,
+} from "../middleware/auth.js";
+import * as service from "../services/prescriptions.js";
+
+export const prescriptionsRouter = Router();
+
+prescriptionsRouter.use(requireAuth, requireOrg);
+
+prescriptionsRouter.get(
+  "/",
+  requirePermission({ prescription: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json(await service.listPrescriptions(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+prescriptionsRouter.post(
+  "/",
+  requirePermission({ prescription: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const input = prescriptionInputSchema.parse(req.body);
+      // Default the prescriber to the signed-in clinician when not provided.
+      input.prescriber = input.prescriber || req.user!.name || "Clinician";
+      const created = await service.createPrescription(
+        req.organizationId!,
+        req.user!.id,
+        input,
+      );
+      res.status(201).json(created);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+prescriptionsRouter.put(
+  "/:id",
+  requirePermission({ prescription: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const input = prescriptionInputSchema.parse(req.body);
+      input.prescriber = input.prescriber || req.user!.name || "Clinician";
+      const updated = await service.updatePrescription(
+        req.organizationId!,
+        req.params.id as string,
+        input,
+      );
+      if (!updated) throw new HttpError(404, "Prescription not found.");
+      res.json(updated);
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+prescriptionsRouter.delete(
+  "/:id",
+  requirePermission({ prescription: ["delete"] }),
+  async (req, res, next) => {
+    try {
+      const ok = await service.deletePrescription(
+        req.organizationId!,
+        req.params.id as string,
+      );
+      if (!ok) throw new HttpError(404, "Prescription not found.");
+      res.status(204).end();
+    } catch (err) {
+      next(err);
+    }
+  },
+);