feat(F-143): completed feature

project/src/app/build-app.ts

@@ -38,6 +38,7 @@ import { registerOrdersRoutes } from '../modules/orders/index.js';
 import { registerCheckoutRoutes } from '../modules/checkout/index.js';
 import { registerPaymentsRoutes } from '../modules/payments/index.js';
 import { registerNotificationsRoutes } from '../modules/notifications/index.js';
+import { registerReportingRoutes } from '../modules/reporting/index.js';
 import { registerReviewsRoutes } from '../modules/reviews/index.js';
 import { registerCmsRoutes } from '../modules/cms/index.js';
 import { registerStoreSettingsRoutes } from '../modules/store-settings/index.js';
@@ -222,6 +223,14 @@ export async function buildApp(deps: BuildAppDeps = {}): Promise<FastifyInstance
       });
     });
 
+    // Reporting contracts + RBAC foundation (F-143). Reporting is backoffice-only
+    // sharing the combined authenticator; it has no DB reads until F-144+.
+    await app.register(async (instance) => {
+      await registerReportingRoutes(instance, {
+        authenticate: combinedAuth,
+      });
+    });
+
     // Session resolution is identity's; users receives it by injection so no
     // module ever imports another module.
     await app.register(async (instance) => {