[rd-code-23]

Summary

Implements the first read-only exercise API used by the routine-building flow. This PR intentionally keeps the scope to the shared response contract and GET /exercises; file-structure reorganization will be handled separately.

Closes #64.

What changed

• Added shared Zod schemas and inferred TypeScript types for an exercise summary and exercise-list response.
• Added authenticated GET /exercises routing.
• Added a database service that returns:
  • all built-in exercises, identified by a null owner;
  • custom exercises owned by the authenticated user;
  • no custom exercises belonging to another user.
• Sorted the results alphabetically by exercise name.
• Mounted the exercise router in the API composition root.
• Added focused contract, route, and service tests.

How the request flows

1. Express receives GET /exercises through the exercise router mounted in app.ts.
2. requireAuthentication rejects requests without a valid server-side session.
3. The route reads the authenticated user ID from the session.
4. The service queries for rows whose owner is either null (built-in) or matches that user ID (their custom exercises).
5. The service converts the private ownerUserId database field into the browser-safe isCustom boolean.
6. The route validates the final payload with exerciseListResponseSchema before returning it.

This split keeps HTTP concerns in the route, database filtering in the service, and the browser/API agreement in the shared contracts package.

Security and data exposure

The ownership filter is performed by the server rather than trusted to the browser. The response deliberately excludes ownerUserId, timestamps, and database row types. Consumers receive only:

• id
• name
• nullable description
• isCustom

Anonymous requests receive 401 authentication_required.

Verification

• Type-checking passed.
• ESLint passed.
• All contract, API, and web tests passed (74 total).
• Formatting passed for every file included in this PR.

Deferred

• Reorganizing the exercise file structure
• Custom exercise creation
• Search and pagination
• Exercise images
• Routine endpoints