backend: prescription start/end dates + dispense ledger

Add optional startDate/endDate columns to prescriptions (schema,
validation, types, service) — when set, endDate drives expiry.

Add a new append-only `dispenses` resource (schema, types, validation,
service, route at /api/dispenses) recording who received which medication,
gated on the existing inventory RBAC statement. Migration 0020.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/dispenses.ts

@@ -0,0 +1,55 @@
+import { Router } from "express";
+
+import { dispenseInputSchema } from "../lib/dispense-validation.js";
+import {
+  requireAuth,
+  requireOrg,
+  requirePermission,
+} from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
+import * as service from "../services/dispenses.js";
+
+// The dispensing ledger. Reuses the `inventory` RBAC statement (pharmacy holds
+// inventory read/write), so no new access-control role is needed.
+export const dispensesRouter = Router();
+
+dispensesRouter.use(requireAuth, requireOrg);
+
+dispensesRouter.get(
+  "/",
+  requirePermission({ inventory: ["read"] }),
+  async (req, res, next) => {
+    try {
+      res.json(await service.listDispenses(req.organizationId!));
+    } catch (err) {
+      next(err);
+    }
+  },
+);
+
+dispensesRouter.post(
+  "/",
+  requirePermission({ inventory: ["write"] }),
+  async (req, res, next) => {
+    try {
+      const input = dispenseInputSchema.parse(req.body);
+      const created = await service.createDispense(
+        req.organizationId!,
+        { id: req.user!.id, name: req.user!.name || "Pharmacy" },
+        input,
+      );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Dispensed ${created.medication} to ${created.name}`,
+        entityType: "dispense",
+        entityId: created.id,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber || null,
+      });
+      res.status(201).json(created);
+    } catch (err) {
+      next(err);
+    }
+  },
+);