feat: add POST /api/orders endpoint for customer order creation

[zshanhui]

Summary

Adds the missing POST /api/orders endpoint that the online ordering frontend needs to create orders after checkout. All new server-side code is TypeScript.

What it does

The endpoint accepts a JSON body and creates:

1. A customer record (with optional phone number)
2. An order linked to the merchant and customer
3. Line items for each menu item in the order

Request / Response

POST /api/orders
Content-Type: application/json

{
  "merchantId": 1,
  "customerName": "Jane Doe",
  "customerPhone": "+15551234567",   // optional
  "orderType": "pickup",             // optional, defaults to "pickup"
  "items": [
    { "menuItemId": 3, "quantity": 2 },
    { "menuItemId": 27, "quantity": 1 }
  ]
}

→ 201 { "orderUuid": "...", "orderId": 17 }
→ 400 { "error": "..." }  (validation)
→ 422 { "error": "..." }  (business rule, e.g. merchant not found)

Changes

File	Change
src/server/models/orders.ts	Converted from JS to TS. Added OrderRow, OrderFilter, CreateParams interfaces. Fixed create() to reliably return UUID on SQLite.
src/server/services/actions.ts	Converted from JS to TS. Added CreateOrderParams interface, typed imports, named exports. Fixed CJS/ESM interop.
src/server/routes/orders.ts	Converted from JS to TS. New POST / route with input validation. Typed Express handlers.
src/server/models/customers.ts	Updated create() to accept optional mobile_phone
src/client/js/api/index.tsx	Added createOrder frontend API helper
specs/services/createOrder.spec.ts	6 unit tests (happy path, phone, order types, validation)
src/server/index.js	Updated require() for new TS default export
src/server/routes/merchants.js	Updated require() for new TS default export

Bug fixes included

• Orders.create SQLite compatibility: .returning('uuid') is silently ignored by SQLite, so the old code returned a row ID instead of a UUID. Now generates the UUID first and returns it directly.
• CJS/ESM interop: Customers and Merchants TS modules use export default, but CJS require() puts them at .default. The old actions.js didn't handle this — now all three files are proper TypeScript with ESM imports.

Demo

create_order_api_demo.mp4

Order created via POST /api/orders appears immediately in the merchant POS dashboard.

Order detail showing API-created order with items and customer info

_{To show artifacts inline, enable in settings.}