backend: prescription start/end dates + dispense ledger

Add optional startDate/endDate columns to prescriptions (schema,
validation, types, service) — when set, endDate drives expiry.

Add a new append-only `dispenses` resource (schema, types, validation,
service, route at /api/dispenses) recording who received which medication,
gated on the existing inventory RBAC statement. Migration 0020.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/lib/dispense-validation.ts

@@ -0,0 +1,20 @@
+import { z } from "zod";
+
+const nonEmpty = z.string().trim().min(1);
+
+// Payload accepted by POST /api/dispenses. Recorded when the pharmacy dispenses
+// a medication (typically from the dispensing queue). The route fills the
+// dispenser identity from the signed-in user and the DB defaults `dispensedAt`.
+export const dispenseInputSchema = z.object({
+  fileNumber: z.string().trim().default(""),
+  name: nonEmpty.max(200),
+  initials: z.string().trim().max(4).default(""),
+  medication: nonEmpty.max(200),
+  dose: z.string().trim().max(120).default(""),
+  quantity: z.number().int().min(0).max(1_000_000).default(0),
+  unit: z.string().trim().max(60).default(""),
+  prescriptionId: z.string().uuid().nullish(),
+  notes: z.string().max(5000).nullish(),
+});
+
+export type DispenseInput = z.infer<typeof dispenseInputSchema>;

backend/src/lib/prescription-validation.ts

@@ -18,6 +18,14 @@ export const prescriptionInputSchema = z.object({
     .string()
     .regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD.")
     .optional(),
+  startDate: z
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD.")
+    .nullish(),
+  endDate: z
+    .string()
+    .regex(/^\d{4}-\d{2}-\d{2}$/, "Date must be YYYY-MM-DD.")
+    .nullish(),
   status: z.enum(["active", "completed", "expired"]).default("active"),
   duration: z.string().trim().max(120).nullish(),
   notes: z.string().max(5000).nullish(),