Add company settings and number sequence API routes

- Add CompanySetting routes (list, get, set) backed by company-scoped store
- Add Number routes (list, update) for managing number sequences
- Register new store namespaces for numbers and companysetting
- Add CompanySetting and NumberSequence schemas to OpenAPI
- Regenerate API docs and index for the new routes

docs/api/routes/companysetting/get.md

@@ -0,0 +1,41 @@
+# `GET /company/setting/{key}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Get company setting by key
+
+Returns a single company setting for the authenticated user's selected
+company, or `404` if it does not exist.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `key` | yes | string |  |
+
+## Response `200`
+
+Company setting
+
+```json
+{
+  "setting": {
+    "key": "…",
+    "value": "…"
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company setting or company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/companysetting/list.md

@@ -0,0 +1,39 @@
+# `GET /company/setting`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List company settings
+
+Returns the visible settings of the authenticated user's selected
+company: the full set of allowed keys (with `value: null` when unset)
+plus any stored settings that are frontend-visible. The `frontend`
+flag is stripped from responses.
+
+
+## Response `200`
+
+Company settings
+
+```json
+{
+  "settings": [
+    {
+      "key": "…",
+      "value": "…"
+    }
+  ]
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/companysetting/set.md

@@ -0,0 +1,51 @@
+# `PUT /company/setting/{key}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Upsert company setting
+
+Sets (upserts) a company setting for the selected company.
+Only a fixed allow-list of keys can be set: `ui.theme`, `keys.tavily`,
+`keys.openrouter`, `labelprinter.addr`, `labelprinter.type`.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `key` | yes | string |  |
+
+## Body (JSON)
+
+```json
+{
+  "value": "dark",
+  "frontend": true
+}
+```
+
+## Response `200`
+
+Upserted company setting
+
+```json
+{
+  "setting": {
+    "key": "…",
+    "value": "…"
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid setting, invalid key, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/number/list.md

@@ -0,0 +1,38 @@
+# `GET /number`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List number sequences
+
+Lists the number sequences of the authenticated user's selected company.
+
+## Response `200`
+
+Number sequence list
+
+```json
+{
+  "numbers": [
+    {
+      "id": 1,
+      "type": "…",
+      "prefix": "…",
+      "padding": 1,
+      "next": 1
+    }
+  ]
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/number/update.md

@@ -0,0 +1,57 @@
+# `PATCH /number/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Update number sequence
+
+Updates sequence settings for the selected company. Only provided fields
+are changed (`prefix`, `padding`, `next`). `prefix` is trimmed and must
+be at most 50 characters. `padding` must be an integer `>= 0`. `next`
+must be an integer `>= 1`. If no field is provided, the row is returned
+unchanged.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Body (JSON)
+
+```json
+{
+  "prefix": "A-",
+  "padding": 4,
+  "next": 100
+}
+```
+
+## Response `200`
+
+Updated number sequence
+
+```json
+{
+  "number": {
+    "id": 1,
+    "type": "…",
+    "prefix": "…",
+    "padding": 1,
+    "next": 1
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid number, invalid id, or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Number sequence or company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._