docs: sync drizzle task contracts

.trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/implement.md

@@ -2,76 +2,91 @@
 
 ## Checklist
 
-1. Add core server modules:
-   - JSON store read/write helpers.
-   - Account/session/password helpers.
-   - Role and permission definitions.
-   - Audit logging helper.
-   - Shared API response helpers.
+1. Reconcile existing Drizzle migration state:
+   - Confirm `modules/core/server/schema.ts` matches `drizzle/` migrations.
+   - Confirm `modules/core/server/db.ts` is the only PostgreSQL connection boundary.
+   - Confirm `modules/core/server/store.ts` is treated as a compatibility read model only.
+   - Remove task assumptions that mention JSON file writes as the target persistence layer.
 
-2. Add auth APIs:
-   - `GET /api/auth/bootstrap`
-   - `POST /api/auth/setup`
-   - `POST /api/auth/login`
-   - `POST /api/auth/logout`
-   - `GET /api/auth/session`
+2. Verify existing auth/RBAC/audit slice:
+   - Confirm setup creates platform admin, organization, session, organization roles, membership, and audit log.
+   - Confirm login/logout uses server APIs and the `teatea_session` HTTP-only cookie.
+   - Confirm `requirePermission` logs denied permission checks.
+   - Confirm roles and permissions cover facility and admission operations.
 
-3. Migrate auth UI:
-   - Update `AuthPanel` to call server APIs.
-   - Update `SignOutButton` to call logout API.
-   - Replace or bypass localStorage-only `AuthGate` with server session protection in the app layout.
-   - Keep unauthenticated redirects and setup redirects working.
+3. Finish elder CRUD on Drizzle:
+   - Keep validation in `modules/elders/types.ts`.
+   - Ensure list/create/update/delete APIs query and mutate Drizzle only.
+   - Ensure elder create with `bedId` performs admission and bed status updates inside a transaction.
+   - Ensure UI refresh and error handling remain usable.
 
-4. Add elder APIs and UI:
-   - Create elder types and input validators.
-   - Implement list/create/update/delete Route Handlers.
-   - Replace `app/(app)/app/elders/page.tsx` static content with server-loaded CRUD UI.
+4. Add or complete bed/admission APIs:
+   - Keep `GET /api/facilities/rooms` and `GET /api/facilities/beds` Drizzle-backed.
+   - Keep `POST /api/admissions` transactional for admit/transfer.
+   - Add discharge and explicit transfer mutation support if the existing POST shape is not enough.
+   - Return structured `{ success, reason, ... }` responses for conflicts and validation failures.
+   - Write audit events for admission create, transfer, discharge, and facility mutations implemented in this task.
 
-5. Add settings/audit UI:
-   - Implement settings/account, role, and audit APIs.
-   - Replace `app/(app)/app/settings/page.tsx` static content with server-loaded tables.
+5. Build bed/admission UI:
+   - Replace "please create through API" empty states with usable controls where permission allows.
+   - Add tabs or segmented navigation for overview, bed status, admission actions/history, and facility records.
+   - Move admission actions into the bed/admission workspace.
+   - Remove or replace the dead global top-bar "入住" button in `AppShell`.
+   - Ensure page layout matches screenshot feedback: compact workspace header, no oversized intro block, local page actions.
 
-6. Wire audit events:
-   - Account setup/create.
-   - Login/logout.
-   - Elder create/update/delete.
-   - Denied permission checks.
+6. Introduce selected Phase 2 UI affordances:
+   - Add tabs to pages that combine overview and management modes.
+   - Keep implementation incremental; do not attempt every sidebar module.
+   - Keep user-facing copy operational and concise.
 
-7. Verification:
+7. Add standard chart usage:
+   - Decide the chart library before adding dependency. Recharts is the likely default unless a better project fit is chosen.
+   - Install the library only after checking existing dependencies.
+   - Replace at least one meaningful hand-built chart with a data-backed chart component.
+   - Keep chart component client-only and pass serializable server data into it.
+
+8. Replace hard-coded operational counters where data exists:
+   - Dashboard bed/elder/admission counters should come from Drizzle-backed data.
+   - Bed/admission workspace metrics should compute from server-loaded rooms, beds, and admissions.
+   - Do not fabricate counters for modules that remain out of scope.
+
+9. Verification:
    - Run `pnpm lint`.
    - Run `pnpm type-check`.
    - Run `pnpm build`.
-   - Start dev server and manually exercise setup/login/CRUD/settings if build passes.
+   - Run Drizzle generation/check commands when schema changes are made.
+   - Start dev server and manually exercise setup/login/elder CRUD/bed admission/transfer/discharge/settings if build passes.
 
 ## Files Expected to Change
 
-- `modules/auth/components/AuthPanel.tsx`
-- `modules/auth/components/AuthGate.tsx`
-- `modules/auth/components/SignOutButton.tsx`
-- `app/(app)/app/layout.tsx`
-- `app/(app)/app/elders/page.tsx`
-- `app/(app)/app/settings/page.tsx`
+- `.trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/prd.md`
+- `.trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/design.md`
+- `.trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/implement.md`
+- `modules/shared/components/AppShell.tsx`
+- `app/(app)/app/beds/page.tsx`
+- `app/(app)/app/dashboard/page.tsx`
+- `modules/dashboard/components/DashboardHome.tsx`
+- `app/api/admissions/route.ts`
+- Potentially `app/api/admissions/[id]/route.ts`
+- Potentially facility UI components under `modules/` if the bed page is split into smaller client/server components.
 
-## Files Expected to Be Created
+## Files Expected to Stay As Existing Foundations
 
-- `modules/core/server/store.ts`
+- `modules/core/server/db.ts`
+- `modules/core/server/schema.ts`
 - `modules/core/server/auth.ts`
 - `modules/core/server/permissions.ts`
 - `modules/core/server/audit.ts`
 - `modules/core/server/api.ts`
-- `modules/elders/types.ts`
-- `modules/elders/components/EldersClient.tsx`
-- `modules/settings/components/SettingsOverview.tsx`
-- `app/api/auth/bootstrap/route.ts`
-- `app/api/auth/setup/route.ts`
-- `app/api/auth/login/route.ts`
-- `app/api/auth/logout/route.ts`
-- `app/api/auth/session/route.ts`
-- `app/api/elders/route.ts`
-- `app/api/elders/[id]/route.ts`
-- `app/api/settings/accounts/route.ts`
-- `app/api/settings/roles/route.ts`
-- `app/api/audit-logs/route.ts`
+- `modules/core/server/store.ts` as a temporary Drizzle-backed read model.
+- Existing auth route handlers unless verification finds a concrete bug.
+- Existing elder route handlers unless admission or bed assignment behavior requires a narrow fix.
+
+## Dependency Notes
+
+- Do not add oRPC or better-auth in this task.
+- Do not reintroduce JSON-file persistence.
+- A standard chart library may be added after dependency review. Prefer a focused dashboard dependency over a broad visualization stack.
 
 ## Validation Commands
 
@@ -79,11 +94,18 @@
 pnpm lint
 pnpm type-check
 pnpm build
-pnpm dev
+pnpm db:generate
+```
+
+If schema files are changed, also validate migrations and run the migration flow against the configured development database:
+
+```bash
+pnpm db:migrate
 ```
 
 ## Rollback Points
 
-- If server auth blocks all app routes, revert only layout/AuthGate changes while keeping APIs.
-- If elder CRUD UI is unstable, keep APIs and temporarily render a read-only server table.
-- If file store causes build/runtime issues, move the data directory to `/tmp` behind the same store API for verification, then restore `.data` once filesystem assumptions are fixed.
+- If admission mutation UI is unstable, keep the Drizzle APIs and temporarily render a read-only admissions table.
+- If discharge/transfer API design becomes too broad, implement only admission create/transfer in this slice and keep discharge as a clearly scoped follow-up.
+- If chart dependency causes build or bundle issues, remove the chart component and keep the server data preparation in place.
+- If tabs cause layout regressions, keep the page-local action placement and defer only the tab styling.