feat: add article search index endpoint and category export.zip

- Add GET /api/articleIndex returning the article search index (listSearchIndex)
- Add GET /api/category/export.zip returning a kategorien.zip with a
  Windows-1252 CSV (depth-first, Ebene N columns) plus one AVIF per category image
  (content-addressed, deduplicated) using jszip

docs/api/routes/articleIndex.md

@@ -0,0 +1,33 @@
+# `GET /articleIndex`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List article search index
+
+Returns every article reachable via the company's category tree.
+Designed for client-side search / autocomplete preload.
+Auth via company access.
+
+
+## Response `200`
+
+Search index
+
+```json
+{
+  "articles": []
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/category/add-image.md

@@ -0,0 +1,44 @@
+# `POST /category/{id}/image`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Add category image
+
+Accepts a full-size AVIF body (`Content-Type: image/avif`).
+Full: stored as-is when already AVIF and ≤1000×1000; otherwise scaled to max 1000×1000.
+Thumb always scaled to max 200×200. Stores hash/thumbhash, links `categorypic`.
+Auth like GET /category/tree — user must be authorized for the category's company.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer | Category id |
+
+## Body
+
+Raw binary (`image/avif`).
+
+## Response `201`
+
+Image stored and linked
+
+```json
+{
+  "category": { … }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Missing body or invalid image — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Category not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/category/delete-image.md

@@ -0,0 +1,37 @@
+# `DELETE /category/{id}/image`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete category image
+
+Removes the category's image. Sets thumbW, thumbH, thumbHash back to null.
+Auth like GET /category/tree — user must be authorized for the category's company.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer | Category id |
+
+## Response `200`
+
+Image removed
+
+```json
+{
+  "category": { … }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Category or image not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/category/export.zip.md

@@ -0,0 +1,29 @@
+# `GET /category/export.zip`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Export categories as ZIP
+
+Builds a `kategorien.zip` for the authenticated user's selected company.
+The ZIP contains `kategorien.csv` (semicolon-separated, Windows-1252,
+depth-first in sort order with an `Ebene N` name column per tree depth)
+plus one AVIF entry per category image, named `<fullHash>.avif`
+(content-addressed, so shared hashes are deduplicated).
+
+
+## Response `200`
+
+ZIP archive
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/delete.md

@@ -0,0 +1,32 @@
+# `DELETE /posterminal/{id}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete POS terminal
+
+Deletes a POS terminal for the selected company.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Response `204`
+
+Deleted
+
+_No content_
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Posterminal not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/list.md

@@ -0,0 +1,30 @@
+# `GET /posterminal`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+List POS terminals
+
+Lists POS terminals for the authenticated user's selected company.
+
+## Response `200`
+
+Posterminal list
+
+```json
+{
+  "posterminals": []
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/setOff.md

@@ -0,0 +1,38 @@
+# `DELETE /posterminal/{id}/category/{categoryId}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Disable category on terminal
+
+Removes a single category's visibility on a terminal (idempotent).
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+| `categoryId` | yes | integer |  |
+
+## Response `200`
+
+Updated category IDs for this terminal
+
+```json
+{
+  "id": 1,
+  "categoryIds": []
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid terminal/category — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Posterminal not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/setOffAll.md

@@ -0,0 +1,37 @@
+# `DELETE /posterminal/{id}/all`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Disable all categories on terminal
+
+Removes all category links for this terminal.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Response `200`
+
+Updated category IDs for this terminal
+
+```json
+{
+  "id": 1,
+  "categoryIds": []
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid terminal — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Posterminal not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/setOn.md

@@ -0,0 +1,38 @@
+# `PUT /posterminal/{id}/category/{categoryId}`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Enable category on terminal
+
+Toggles a single category's visibility on a terminal (idempotent).
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+| `categoryId` | yes | integer |  |
+
+## Response `200`
+
+Updated category IDs for this terminal
+
+```json
+{
+  "id": 1,
+  "categoryIds": []
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid terminal/category — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Posterminal not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/setOnAll.md

@@ -0,0 +1,39 @@
+# `PUT /posterminal/{id}/all`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Enable all categories on terminal
+
+Walks the company's category tree and inserts any missing links
+for this terminal. Returns the updated category IDs.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer |  |
+
+## Response `200`
+
+Updated category IDs for this terminal
+
+```json
+{
+  "id": 1,
+  "categoryIds": []
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid terminal — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Posterminal not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/posterminal/upsert.md

@@ -0,0 +1,40 @@
+# `PUT /posterminal`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Create POS terminal
+
+Creates a new POS terminal for the selected company.
+The pairingpin is randomly generated server-side and returned in the response.
+
+
+## Body (JSON)
+
+```json
+{
+  "name": "Kassa 1"
+}
+```
+
+## Response `200`
+
+Created posterminal with generated pairingpin
+
+```json
+{
+  "posterminal": { … }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Invalid posterminal or no company selected — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Company not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._