Migrate TREK 3 to NestJS + React 19 with a shared Zod contract layer

Brownfield strangler migration of the backend onto NestJS modules
(auth, trips, days, places, assignments, packing, todo, budget,
reservations, collab, files, photos, journey, share, settings, backup,
oidc, oauth, admin, atlas, vacay, weather, airports, maps, categories,
tags, notifications, system-notices) served through a per-prefix
dispatcher, keeping the existing SQLite/better-sqlite3 DB and JWT
httpOnly cookie auth, with behavioural parity for every route.

Client: React 19 upgrade, "page = wiring container + data hook"
pattern across all pages, per-domain Zustand stores bound to
@trek/shared contracts, and decomposition of the large components
(DayPlanSidebar, PackingListPanel, CollabNotes, FileManager,
MemoriesPanel, PlacesSidebar, CollabChat, SystemNoticeModal,
BudgetPanel, PlaceFormModal, ...) into focused render units backed by
in-file hooks.

Apply the shared global request pipeline (helmet/CSP, CORS, HSTS,
forced HTTPS, the global MFA policy and request logging) to the NestJS
instance as well, so a migrated route is protected identically to the
legacy fallback rather than bypassing it.

shared/src/day/day.schema.spec.ts

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest';
+import {
+  dayCreateRequestSchema,
+  dayNoteCreateRequestSchema,
+  dayNoteUpdateRequestSchema,
+} from './day.schema';
+
+describe('dayCreateRequestSchema', () => {
+  it('accepts an optional date + notes', () => {
+    expect(dayCreateRequestSchema.safeParse({}).success).toBe(true);
+    expect(dayCreateRequestSchema.safeParse({ date: '2026-07-01', notes: 'n' }).success).toBe(true);
+  });
+});
+
+describe('dayNoteCreateRequestSchema', () => {
+  it('requires non-empty text capped at 500, time capped at 150', () => {
+    expect(dayNoteCreateRequestSchema.safeParse({ text: 'Lunch' }).success).toBe(true);
+    expect(dayNoteCreateRequestSchema.safeParse({ text: '' }).success).toBe(false);
+    expect(dayNoteCreateRequestSchema.safeParse({ text: 'x'.repeat(501) }).success).toBe(false);
+    expect(dayNoteCreateRequestSchema.safeParse({ text: 'ok', time: 'y'.repeat(151) }).success).toBe(false);
+  });
+});
+
+describe('dayNoteUpdateRequestSchema', () => {
+  it('allows omitting text and caps the lengths', () => {
+    expect(dayNoteUpdateRequestSchema.safeParse({}).success).toBe(true);
+    expect(dayNoteUpdateRequestSchema.safeParse({ icon: '🍽️' }).success).toBe(true);
+    expect(dayNoteUpdateRequestSchema.safeParse({ text: 'x'.repeat(501) }).success).toBe(false);
+  });
+});

shared/src/day/day.schema.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+
+/**
+ * Day + day-note API contract — single source of truth for the
+ * /api/trips/:tripId/days and /api/trips/:tripId/days/:dayId/notes endpoints.
+ *
+ * Trip-scoped, both gated by the 'day_edit' permission. The legacy routes
+ * (server/src/routes/days.ts + routes/dayNotes.ts) wrap dayService /
+ * dayNoteService. Day rows (with their assignments) are wide and DB-derived, so
+ * list responses stay open. Day notes cap text at 500 and time at 150 chars
+ * (the legacy validateStringLengths middleware) — reproduced in the controller.
+ */
+
+export const dayCreateRequestSchema = z.object({
+  date: z.string().optional(),
+  notes: z.string().optional(),
+});
+export type DayCreateRequest = z.infer<typeof dayCreateRequestSchema>;
+
+export const dayUpdateRequestSchema = z.object({
+  notes: z.string().optional(),
+  title: z.string().nullable().optional(),
+});
+export type DayUpdateRequest = z.infer<typeof dayUpdateRequestSchema>;
+
+export const dayNoteCreateRequestSchema = z.object({
+  text: z.string().min(1).max(500),
+  time: z.string().max(150).optional(),
+  icon: z.string().optional(),
+  sort_order: z.number().optional(),
+});
+export type DayNoteCreateRequest = z.infer<typeof dayNoteCreateRequestSchema>;
+
+export const dayNoteUpdateRequestSchema = z.object({
+  text: z.string().max(500).optional(),
+  time: z.string().max(150).optional(),
+  icon: z.string().optional(),
+  sort_order: z.number().optional(),
+});
+export type DayNoteUpdateRequest = z.infer<typeof dayNoteUpdateRequestSchema>;