Migrate the API to native ESM and vitest; pin Node 26

Prep PR for the admin auth module (docs/plan-admin-auth.md step 1).
better-auth 1.7 ships ESM only, so the API moves off CommonJS:

- "type": "module", module nodenext, target ES2024, .js suffixes on all
  relative imports, require('mariadb'|'cors') replaced by imports, and
  export= packages (winston, app-root-path, bcrypt) consumed via default
  imports. The logger now uses appRoot.path explicitly.
- TypeScript 5.9, @types/node 26, tslint removed. Node 26 pinned via
  engines and .nvmrc (Plesk runs 26).
- Jest 28 + ts-jest replaced by vitest 5. Eight test files depend on
  hoisted module mocks with static imports and resetModules + require,
  which Jest's ESM mode does not support; vitest keeps them nearly
  verbatim. Coverage via @vitest/coverage-v8 (lcov), Sonar generic report
  via vitest-sonar-reporter, so sonar-project.properties is unchanged.
  vitest.config.ts sets FEEDBACK_IP_SALT so the suite passes without a
  local .env.
- dotenv 8 -> 16 and axios 0.24 -> 1.x: their old typings are not
  resolvable under nodenext.
- autoCommit: false dropped from the pool configs; it is not a mariadb
  connector option and was silently ignored.

tsc clean, 96/96 tests green, compiled app boots and serves /, /docs and
CORS under Node ESM.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/models/tickets/Tickets.db.ts

@@ -1,6 +1,5 @@
 import * as dotenv from 'dotenv';
-
-const mariadb = require('mariadb');
+import mariadb from 'mariadb';
 
 dotenv.config();
 
@@ -10,8 +9,7 @@ export namespace NachklangTicketsDB {
 		user: process.env.DB_USER,
 		password: process.env.DB_PASSWORD,
 		database: process.env.TICKETS_DB,
-		connectionLimit: 5,
-		autoCommit: false
+		connectionLimit: 5
 	});
 
 	export const getConnection = async () => {

src/models/tickets/Tickets.router.ts

@@ -1,6 +1,6 @@
 import express from 'express';
-import {adminRouter} from './admin/admin.router';
-import {publicRouter} from './public/public.router';
+import {adminRouter} from './admin/admin.router.js';
+import {publicRouter} from './public/public.router.js';
 
 export const ticketsRouter = express.Router();
 

src/models/tickets/admin/admin.router.ts

@@ -1,8 +1,8 @@
 import express, {Request, Response} from 'express';
-import {requireAdminAuth} from '../tickets.auth';
-import {vouchersAdminRouter} from './vouchers.admin.router';
-import {redemptionsAdminRouter, voucherHistoryRouter} from './redemptions.admin.router';
-import {eventsAdminRouter} from './events.admin.router';
+import {requireAdminAuth} from '../tickets.auth.js';
+import {vouchersAdminRouter} from './vouchers.admin.router.js';
+import {redemptionsAdminRouter, voucherHistoryRouter} from './redemptions.admin.router.js';
+import {eventsAdminRouter} from './events.admin.router.js';
 
 export const adminRouter = express.Router();
 

src/models/tickets/admin/events.admin.router.ts

@@ -1,6 +1,6 @@
 import express, {Request, Response} from 'express';
-import * as EventsAdminService from './events.admin.service';
-import {sendServerError} from '../tickets.errors';
+import * as EventsAdminService from './events.admin.service.js';
+import {sendServerError} from '../tickets.errors.js';
 
 export const eventsAdminRouter = express.Router();
 

src/models/tickets/admin/events.admin.service.ts

@@ -1,7 +1,7 @@
-import * as CalendarEventsService from '../../calendar/events/events.service';
-import {NachklangTicketsDB} from '../Tickets.db';
-import {getEventTicketState} from '../tickets.capacity';
-import {EventStats, EventTicketSettings} from '../tickets.interface';
+import * as CalendarEventsService from '../../calendar/events/events.service.js';
+import {NachklangTicketsDB} from '../Tickets.db.js';
+import {getEventTicketState} from '../tickets.capacity.js';
+import {EventStats, EventTicketSettings} from '../tickets.interface.js';
 
 // Concerts are managed on the public calendar (calendarId 1) - see
 // docs/plan-ticket-shop.md. getAllEventsAdmin includes DRAFT events so

src/models/tickets/admin/redemptions.admin.router.ts

@@ -1,6 +1,6 @@
 import express, {Request, Response} from 'express';
-import * as RedemptionsAdminService from './redemptions.admin.service';
-import {sendServerError} from '../tickets.errors';
+import * as RedemptionsAdminService from './redemptions.admin.service.js';
+import {sendServerError} from '../tickets.errors.js';
 
 export const redemptionsAdminRouter = express.Router();
 

src/models/tickets/admin/redemptions.admin.service.ts

@@ -1,8 +1,8 @@
-import {NachklangTicketsDB} from '../Tickets.db';
-import {getEventTicketState} from '../tickets.capacity';
-import {recordConfirmationEmailResult, sendRedemptionConfirmation} from '../tickets.confirmation-email';
-import {AuditLogEntry, RedemptionSummary} from '../tickets.interface';
-import {isValidEmail} from '../tickets.validation';
+import {NachklangTicketsDB} from '../Tickets.db.js';
+import {getEventTicketState} from '../tickets.capacity.js';
+import {recordConfirmationEmailResult, sendRedemptionConfirmation} from '../tickets.confirmation-email.js';
+import {AuditLogEntry, RedemptionSummary} from '../tickets.interface.js';
+import {isValidEmail} from '../tickets.validation.js';
 
 const mapRedemptionRow = (row: any, guests: string[]): RedemptionSummary => ({
 	redemptionId: row.redemption_id,

src/models/tickets/admin/vouchers.admin.router.ts

@@ -1,6 +1,6 @@
 import express, {Request, Response} from 'express';
-import * as VouchersAdminService from './vouchers.admin.service';
-import {sendServerError} from '../tickets.errors';
+import * as VouchersAdminService from './vouchers.admin.service.js';
+import {sendServerError} from '../tickets.errors.js';
 
 export const vouchersAdminRouter = express.Router();
 

src/models/tickets/admin/vouchers.admin.service.ts

@@ -1,8 +1,8 @@
 import {Guid} from 'guid-typescript';
-import {NachklangTicketsDB} from '../Tickets.db';
-import {generateUniqueCode} from '../tickets.codes';
-import {VoucherCode, VoucherStatus} from '../tickets.interface';
-import {isValidEmail} from '../tickets.validation';
+import {NachklangTicketsDB} from '../Tickets.db.js';
+import {generateUniqueCode} from '../tickets.codes.js';
+import {VoucherCode, VoucherStatus} from '../tickets.interface.js';
+import {isValidEmail} from '../tickets.validation.js';
 
 export interface WildcardGenerateInput {
 	eventIds: number[];

src/models/tickets/public/public.router.ts

@@ -1,7 +1,7 @@
 import express, {Request, Response} from 'express';
-import * as VoucherPublicService from './voucher.public.service';
-import {sendServerError} from '../tickets.errors';
-import {hashIp, redeemLimiter, validateLimiter} from '../tickets.ratelimit';
+import * as VoucherPublicService from './voucher.public.service.js';
+import {sendServerError} from '../tickets.errors.js';
+import {hashIp, redeemLimiter, validateLimiter} from '../tickets.ratelimit.js';
 
 export const publicRouter = express.Router();
 

src/models/tickets/public/voucher.public.service.ts

@@ -1,10 +1,10 @@
-import * as EventsService from '../../calendar/events/events.service';
-import logger from '../../../middleware/logger';
-import {NachklangTicketsDB} from '../Tickets.db';
-import {getEventTicketState} from '../tickets.capacity';
-import {recordConfirmationEmailResult, sendRedemptionConfirmation} from '../tickets.confirmation-email';
-import {EligibleEvent, RedeemRequest, VoucherValidation} from '../tickets.interface';
-import {isValidEmail} from '../tickets.validation';
+import * as EventsService from '../../calendar/events/events.service.js';
+import logger from '../../../middleware/logger.js';
+import {NachklangTicketsDB} from '../Tickets.db.js';
+import {getEventTicketState} from '../tickets.capacity.js';
+import {recordConfirmationEmailResult, sendRedemptionConfirmation} from '../tickets.confirmation-email.js';
+import {EligibleEvent, RedeemRequest, VoucherValidation} from '../tickets.interface.js';
+import {isValidEmail} from '../tickets.validation.js';
 
 /**
  * Builds the eligible-events list for a code: for each event it's linked

src/models/tickets/tickets.auth.ts

@@ -1,6 +1,6 @@
 import express from 'express';
-import * as UserService from '../calendar/users/users.service';
-import {sendServerError} from './tickets.errors';
+import * as UserService from '../calendar/users/users.service.js';
+import {sendServerError} from './tickets.errors.js';
 
 /**
  * Mirrors the Feedback module's feedback.auth.ts: this is the ONLY place in

src/models/tickets/tickets.confirmation-email.ts

@@ -1,8 +1,8 @@
-import * as EventsService from '../calendar/events/events.service';
-import * as IcalService from '../calendar/events/icalgenerator.service';
-import {MailService} from '../../common/common.mail';
-import logger from '../../middleware/logger';
-import {NachklangTicketsDB} from './Tickets.db';
+import * as EventsService from '../calendar/events/events.service.js';
+import * as IcalService from '../calendar/events/icalgenerator.service.js';
+import {MailService} from '../../common/common.mail.js';
+import logger from '../../middleware/logger.js';
+import {NachklangTicketsDB} from './Tickets.db.js';
 
 export type ConfirmationEmailStatus = 'SENT' | 'FAILED';
 

src/models/tickets/tickets.errors.ts

@@ -1,6 +1,6 @@
 import {Response} from 'express';
 import {Guid} from 'guid-typescript';
-import logger from '../../middleware/logger';
+import logger from '../../middleware/logger.js';
 
 /**
  * The tickets module's standard catch-block response: log with a reference