Migrate TREK 3 to NestJS + React 19 with a shared Zod contract layer

Brownfield strangler migration of the backend onto NestJS modules
(auth, trips, days, places, assignments, packing, todo, budget,
reservations, collab, files, photos, journey, share, settings, backup,
oidc, oauth, admin, atlas, vacay, weather, airports, maps, categories,
tags, notifications, system-notices) served through a per-prefix
dispatcher, keeping the existing SQLite/better-sqlite3 DB and JWT
httpOnly cookie auth, with behavioural parity for every route.

Client: React 19 upgrade, "page = wiring container + data hook"
pattern across all pages, per-domain Zustand stores bound to
@trek/shared contracts, and decomposition of the large components
(DayPlanSidebar, PackingListPanel, CollabNotes, FileManager,
MemoriesPanel, PlacesSidebar, CollabChat, SystemNoticeModal,
BudgetPanel, PlaceFormModal, ...) into focused render units backed by
in-file hooks.

Apply the shared global request pipeline (helmet/CSP, CORS, HSTS,
forced HTTPS, the global MFA policy and request logging) to the NestJS
instance as well, so a migrated route is protected identically to the
legacy fallback rather than bypassing it.

shared/src/reservation/reservation.schema.spec.ts

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import {
+  reservationCreateRequestSchema,
+  reservationPositionsRequestSchema,
+  accommodationCreateRequestSchema,
+} from './reservation.schema';
+
+describe('reservationCreateRequestSchema', () => {
+  it('requires a title and keeps the other booking fields open', () => {
+    expect(reservationCreateRequestSchema.safeParse({ title: 'Hotel', anything: 1, metadata: {} }).success).toBe(true);
+    expect(reservationCreateRequestSchema.safeParse({ location: 'x' }).success).toBe(false);
+  });
+});
+
+describe('reservationPositionsRequestSchema', () => {
+  it('requires positions with id + day_plan_position', () => {
+    expect(reservationPositionsRequestSchema.safeParse({ positions: [{ id: 1, day_plan_position: 0 }], day_id: 3 }).success).toBe(true);
+    expect(reservationPositionsRequestSchema.safeParse({ positions: [{ id: 1 }] }).success).toBe(false);
+  });
+});
+
+describe('accommodationCreateRequestSchema', () => {
+  it('requires place + start/end day; check-in/out optional', () => {
+    expect(accommodationCreateRequestSchema.safeParse({ place_id: 2, start_day_id: 10, end_day_id: 11 }).success).toBe(true);
+    expect(accommodationCreateRequestSchema.safeParse({ place_id: 2 }).success).toBe(false);
+  });
+});

shared/src/reservation/reservation.schema.ts

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+
+/**
+ * Reservation + accommodation API contract — single source of truth for the
+ * /api/trips/:tripId/reservations and /api/trips/:tripId/accommodations endpoints.
+ *
+ * Trip-scoped. Reservations use the 'reservation_edit' permission; accommodations
+ * use 'day_edit' (they live in the day/accommodation service). The legacy routes
+ * (server/src/routes/reservations.ts + the accommodations sub-router in
+ * routes/days.ts) carry several side effects — auto-creating/updating/deleting a
+ * linked budget item, accommodation broadcasts and booking notifications — which
+ * the Nest service reproduces 1:1. Reservation bodies are wide and provider-ish,
+ * so the create/update payloads stay mostly open with `title` pinned.
+ */
+
+const open = z.record(z.string(), z.unknown());
+
+/** Reservation create: title is required; the many optional fields stay open. */
+export const reservationCreateRequestSchema = open.and(z.object({ title: z.string().min(1) }));
+export type ReservationCreateRequest = z.infer<typeof reservationCreateRequestSchema>;
+
+export const reservationUpdateRequestSchema = open;
+export type ReservationUpdateRequest = z.infer<typeof reservationUpdateRequestSchema>;
+
+export const reservationPositionsRequestSchema = z.object({
+  positions: z.array(z.object({ id: z.number(), day_plan_position: z.number() })),
+  day_id: z.union([z.number(), z.string()]).nullable().optional(),
+});
+export type ReservationPositionsRequest = z.infer<typeof reservationPositionsRequestSchema>;
+
+export const accommodationCreateRequestSchema = z.object({
+  place_id: z.union([z.number(), z.string()]),
+  start_day_id: z.union([z.number(), z.string()]),
+  end_day_id: z.union([z.number(), z.string()]),
+  check_in: z.string().nullable().optional(),
+  check_in_end: z.string().nullable().optional(),
+  check_out: z.string().nullable().optional(),
+  confirmation: z.string().nullable().optional(),
+  notes: z.string().nullable().optional(),
+});
+export type AccommodationCreateRequest = z.infer<typeof accommodationCreateRequestSchema>;
+
+export const accommodationUpdateRequestSchema = open;
+export type AccommodationUpdateRequest = z.infer<typeof accommodationUpdateRequestSchema>;