feat: add bot-facing API routes (catalog, areas, employees, asset-models, inventory-scans)

Auth via BOT_INGEST_SECRET bearer header (src/lib/bot-auth.ts), not Auth.js session -- caller is the inventory-capture Telegram bot service, not a browser.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

src/app/api/bot/areas/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from "next/server";
+import { requireBotAuth } from "@/lib/bot-auth";
+import { createOrGetArea, listAreas, validateCreateAreaInput } from "@/lib/areas";
+
+// Bot-facing Area list/create — see src/lib/areas.ts's createOrGetArea()
+// comment for why POST is idempotent-by-name rather than erroring on a
+// name the bot's own keyboard just offered as an existing option.
+export async function GET(request: Request): Promise<NextResponse> {
+  if (!requireBotAuth(request)) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  const areas = await listAreas();
+  return NextResponse.json({ areas });
+}
+
+export async function POST(request: Request): Promise<NextResponse> {
+  if (!requireBotAuth(request)) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  let body: unknown;
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
+  }
+  if (typeof body !== "object" || body === null) {
+    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
+  }
+
+  const { name, team } = body as Record<string, unknown>;
+  const validation = validateCreateAreaInput({ name, team });
+  if (!validation.ok) {
+    return NextResponse.json({ error: validation.error }, { status: 400 });
+  }
+
+  const created = await createOrGetArea(validation.value);
+  if (!created.ok) {
+    return NextResponse.json({ error: created.error }, { status: 400 });
+  }
+  return NextResponse.json(created.value, { status: 201 });
+}