feat: add article search index endpoint and category export.zip

- Add GET /api/articleIndex returning the article search index (listSearchIndex)
- Add GET /api/category/export.zip returning a kategorien.zip with a
  Windows-1252 CSV (depth-first, Ebene N columns) plus one AVIF per category image
  (content-addressed, deduplicated) using jszip

src/api/routes/category.js

@@ -1,5 +1,8 @@
 import express from 'express';
+import JSZip from 'jszip';
 import * as db from '../../db/category.js';
+import * as picDb from '../../db/pic.js';
+import { buildKategorienCsv, toWindows1252 } from '../../util/kategorienCsv.js';
 
 const AVIF_BODY_LIMIT = '20mb';
 
@@ -101,6 +104,91 @@ export function register(app, basePath = '') {
         }
     });
 
+    /**
+     * @openapi
+     * /category/export.zip:
+     *   get:
+     *     tags: [Category]
+     *     summary: Export categories as ZIP
+     *     description: |
+     *       Builds a `kategorien.zip` for the authenticated user's selected company.
+     *       The ZIP contains `kategorien.csv` (semicolon-separated, Windows-1252,
+     *       depth-first in sort order with an `Ebene N` name column per tree depth)
+     *       plus one AVIF entry per category image, named `<fullHash>.avif`
+     *       (content-addressed, so shared hashes are deduplicated).
+     *     security:
+     *       - cookieAuth: []
+     *     responses:
+     *       200:
+     *         description: ZIP archive
+     *         content:
+     *           application/zip:
+     *             schema:
+     *               type: string
+     *               format: binary
+     *       400:
+     *         description: No company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Company not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/category/export.zip`, async (req, res) => {
+        const companyId = req.user.selectedCompanyId;
+        if (companyId == null) {
+            return res.status(400).json({ error: 'No company selected' });
+        }
+
+        try {
+            const { tree } = await db.getTreeForCompany(req.user.id, companyId);
+
+            const csv = buildKategorienCsv(tree, tree.find((n) => n.parentId == null)?.id ?? null);
+
+            const zip = new JSZip();
+            zip.file('kategorien.csv', toWindows1252(csv));
+
+            const seen = new Set();
+            for (const node of tree) {
+                const fullHash = node.fullHash;
+                if (!fullHash || seen.has(fullHash)) continue;
+                seen.add(fullHash);
+                try {
+                    const { buffer } = await picDb.getImageByHash(req.user.id, fullHash);
+                    zip.file(`${fullHash}.avif`, buffer);
+                } catch (error) {
+                    // Skip images this user cannot access; CSV already carries the hash.
+                }
+            }
+
+            const content = await zip.generateAsync({ type: 'nodebuffer' });
+            res.setHeader('Content-Type', 'application/zip');
+            res.setHeader('Content-Disposition', 'attachment; filename="kategorien.zip"');
+            res.status(200).send(content);
+        } catch (error) {
+            const status = categoryErrorStatus(error);
+            if (status === 500) console.error('Export categories failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
     /**
      * @openapi
      * /category: