backend: prescription start/end dates + dispense ledger

Add optional startDate/endDate columns to prescriptions (schema,
validation, types, service) — when set, endDate drives expiry.

Add a new append-only `dispenses` resource (schema, types, validation,
service, route at /api/dispenses) recording who received which medication,
gated on the existing inventory RBAC statement. Migration 0020.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/index.ts

@@ -14,6 +14,7 @@ import { analyticsRouter } from "./routes/analytics.js";
 import { appointmentsRouter } from "./routes/appointments.js";
 import { chatRouter } from "./routes/chat.js";
 import { conversationsRouter } from "./routes/conversations.js";
+import { dispensesRouter } from "./routes/dispenses.js";
 import { inventoryRouter } from "./routes/inventory.js";
 import { invoicesRouter } from "./routes/invoices.js";
 import { notesRouter } from "./routes/notes.js";
@@ -66,6 +67,7 @@ app.use("/api/notes", notesRouter);
 app.use("/api/appointments", appointmentsRouter);
 app.use("/api/prescriptions", prescriptionsRouter);
 app.use("/api/inventory", inventoryRouter);
+app.use("/api/dispenses", dispensesRouter);
 app.use("/api/invoices", invoicesRouter);
 app.use("/api/tasks", tasksRouter);
 app.use("/api/staff", staffRouter);
@@ -92,6 +94,7 @@ server.listen(env.PORT, () => {
   console.log(`  • appts:    /api/appointments`);
   console.log(`  • rx:       /api/prescriptions`);
   console.log(`  • stock:    /api/inventory`);
+  console.log(`  • dispense: /api/dispenses`);
   console.log(`  • tasks:    /api/tasks`);
   console.log(`  • staff:    /api/staff`);
   console.log(`  • activity: /api/activity`);