feat(search): /api/search route

packages/backend/src/app.ts

@@ -16,6 +16,7 @@ import { statsRouter } from './routes/stats.js';
 import { subscriptionsRouter } from './routes/subscriptions.js';
 import { marketplaceRouter } from './routes/marketplace.js';
 import { adminLessonsRouter } from './routes/admin-lessons.js';
+import { searchRouter } from './routes/search.js';
 
 export function createApp(db: Db): Express {
   const app = express();
@@ -40,6 +41,7 @@ export function createApp(db: Db): Express {
   app.use('/api/admin/lessons', requireAuth, requireRole('sysadmin'), verifyCsrf, adminLessonsRouter(db));
   app.use('/api', requireAuth, verifyCsrf, subscriptionsRouter(db));
   app.use('/api/marketplace', requireAuth, marketplaceRouter(db));
+  app.use('/api/search', requireAuth, searchRouter(db));
 
   // Static frontend in production
   const frontendDist = resolve(import.meta.dirname, '../../frontend/dist');

packages/backend/src/routes/search.ts

@@ -0,0 +1,17 @@
+import { Router } from 'express';
+import type { Db } from '../db/client.js';
+import { searchAll } from '../services/search.js';
+
+export function searchRouter(db: Db): Router {
+  const r = Router();
+
+  r.get('/', async (req, res, next) => {
+    try {
+      const q = typeof req.query.q === 'string' ? req.query.q : '';
+      const limit = Math.min(100, Math.max(1, Number(req.query.limit ?? 30)));
+      res.json(await searchAll(db, req.user!.id, q, limit));
+    } catch (e) { next(e); }
+  });
+
+  return r;
+}