Add delivery and supplier HTTP APIs with expanded response docs.

Wire store-backed CRUD for goods receipts and suppliers, and teach the API doc generator to expand $ref/allOf/array samples so route markdown shows full JSON shapes.

docs/api/routes/supplier/create.md

@@ -0,0 +1,44 @@
+# `POST /supplier`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Create supplier
+
+Creates a supplier in the company `Lieferanten` group (created on first use).
+
+
+## Body (JSON)
+
+```json
+{
+  "name": "Großhandel Müller"
+}
+```
+
+## Response `201`
+
+Created supplier
+
+```json
+{
+  "supplier": {
+    "id": 1,
+    "name": "…",
+    "createdAt": "2026-08-10T00:00:00.000Z",
+    "updatedAt": "2026-08-10T00:00:00.000Z"
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Name required or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/supplier/delete.md

@@ -0,0 +1,34 @@
+# `DELETE /supplier/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete supplier
+
+Deletes the supplier entity for the selected company.
+Related `entityhistory` cascades; `manifest.entity_id` is set null.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Response `204`
+
+Deleted
+
+_No content_
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid id — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Supplier not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/supplier/list.md

@@ -0,0 +1,39 @@
+# `GET /supplier`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List suppliers
+
+Lists suppliers (`entity` rows in the company `Lieferanten` customergroup)
+for the authenticated user's selected company.
+
+
+## Response `200`
+
+Supplier list
+
+```json
+{
+  "suppliers": [
+    {
+      "id": 1,
+      "name": "…",
+      "createdAt": "2026-08-10T00:00:00.000Z",
+      "updatedAt": "2026-08-10T00:00:00.000Z"
+    }
+  ]
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/supplier/update.md

@@ -0,0 +1,49 @@
+# `PATCH /supplier/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Update supplier
+
+Renames a supplier for the selected company.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Body (JSON)
+
+```json
+{
+  "name": "Großhandel Müller GmbH"
+}
+```
+
+## Response `200`
+
+Updated supplier
+
+```json
+{
+  "supplier": {
+    "id": 1,
+    "name": "…",
+    "createdAt": "2026-08-10T00:00:00.000Z",
+    "updatedAt": "2026-08-10T00:00:00.000Z"
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Name required, invalid id, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Supplier or company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._