Initial commit: EatMe attendance tracker

Google-SSO PWA for bistro employee clock-in/out, admin employee
management, and stats with CSV export. Express + SQLite backend,
React + Zustand frontend in the light-mono-tui design language.
Multi-stage Dockerfile, compose.yaml for image-based deploys, nginx
reverse-proxy template, and an OKF documentation bundle in docs/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/api/auth-routes.md

@@ -0,0 +1,51 @@
+---
+type: API Endpoint
+title: Auth routes
+description: POST /api/auth/google, POST /api/auth/logout, GET /api/auth/me.
+resource: backend/src/routes/auth.ts
+tags: [api, auth]
+timestamp: 2026-08-12T00:00:00Z
+---
+
+# Auth routes
+
+Mounted at `/api/auth` (`backend/src/index.ts`).
+
+# Examples
+
+```
+POST /api/auth/google
+Body: { "credential": "<google id token>" }
+200 -> { "user": SessionUser }
+400 -> missing credential
+401 -> invalid Google token
+403 -> email not verified, or not an admin and not an active employee
+```
+
+Sets the `eatme_session` cookie on success. See
+[Auth flow](/docs/architecture/auth-flow.md) for what happens before this
+(role resolution) and what's inside the cookie.
+
+```
+POST /api/auth/logout
+204, clears the session cookie. No auth required.
+```
+
+```
+GET /api/auth/me
+Requires a valid session cookie (requireAuth).
+200 -> { "user": SessionUser }
+401 -> not authenticated
+```
+
+`SessionUser` shape (`backend/src/types.ts`):
+
+```ts
+{ email: string; name: string | null; role: "admin" | "employee"; employeeId: number | null }
+```
+
+# Related
+
+- [Auth flow](/docs/architecture/auth-flow.md)
+- [Attendance routes](./attendance-routes.md)
+- [Admin routes](./admin-routes.md)