fix architecture and write new tests

apps/api/src/modules/auth/auth.employee.routes.ts

@@ -2,6 +2,7 @@ import { Router } from 'express'
 import { requireCompanyAuth } from '../../middleware/requireCompanyAuth'
 import { parseBody } from '../../http/validate'
 import { ok } from '../../http/respond'
+import { setSessionCookie, clearSessionCookie } from '../../security/sessionCookies'
 import { getEmployeeMenu } from '../menu/menu.service'
 import {
   employeeForgotPasswordSchema,
@@ -28,10 +29,17 @@ router.get('/menu', requireCompanyAuth, async (req, res, next) => {
 router.post('/login', async (req, res, next) => {
   try {
     const body = parseBody(employeeLoginSchema, req)
-    ok(res, await service.login(body))
+    const result = await service.login(body)
+    if ('token' in result) setSessionCookie(res, 'employee', result.token, 8 * 60 * 60 * 1000)
+    ok(res, result)
   } catch (err) { next(err) }
 })
 
+router.post('/logout', (_req, res) => {
+  clearSessionCookie(res, 'employee')
+  ok(res, { success: true })
+})
+
 router.post('/forgot-password', async (req, res, next) => {
   try {
     const { email } = parseBody(employeeForgotPasswordSchema, req)