fix first online resevation

apps/api/src/index.ts

@@ -13,8 +13,9 @@ import { authLimiter, apiLimiter, publicLimiter, adminLimiter } from './middlewa
 
 // ─── Routes ───────────────────────────────────────────────────
 import webhookRouter     from './routes/webhooks'
-import companyAuthRouter from './routes/auth.company'
-import renterAuthRouter  from './routes/auth.renter'
+import companyAuthRouter  from './routes/auth.company'
+import employeeAuthRouter from './routes/auth.employee'
+import renterAuthRouter   from './routes/auth.renter'
 import vehiclesRouter    from './routes/vehicles'
 import reservationsRouter from './routes/reservations'
 import teamRouter        from './routes/team'
@@ -114,6 +115,9 @@ subscriber.on('pmessage', (_pattern, channel, message) => {
 })
 
 // ─── Middleware ────────────────────────────────────────────────
+// Serve local file storage
+app.use('/storage', express.static(require('path').resolve(__dirname, 'lib/storage')))
+
 // Webhook must use raw body BEFORE express.json()
 app.use('/api/v1/webhooks', express.raw({ type: 'application/json' }), webhookRouter)
 
@@ -124,8 +128,9 @@ app.use(express.json({ limit: '10mb' }))
 
 // ─── API Routes ───────────────────────────────────────────────
 // Auth routes: strict brute-force protection
-app.use(`${v1}/auth/renter`,   authLimiter, renterAuthRouter)
-app.use(`${v1}/auth/company`,  authLimiter, companyAuthRouter)
+app.use(`${v1}/auth/renter`,    authLimiter, renterAuthRouter)
+app.use(`${v1}/auth/company`,   authLimiter, companyAuthRouter)
+app.use(`${v1}/auth/employee`,  authLimiter, employeeAuthRouter)
 
 // Admin routes: dedicated limit
 app.use(`${v1}/admin`,         adminLimiter, adminRouter)