feat(04-01): InventoryService, API routes, migration, and 13 passing tests

- InventoryService: registerItem, recordMovement, getStockLevels, getItemMovements, listItems
- RECEIVED movements auto-post JE (DR 1200 Equipment Inventory, CR 2010 AP)
- Stock levels derived from movement aggregation (no mutable quantity column)
- All 5 movement types validated with type-specific rules
- API routes: POST/GET items, GET item detail, POST/GET movements, GET stock-levels
- CASL: OFFICE_STAFF gets manage Inventory permission
- Migration applied: add_inventory_models (4 enums, 2 tables)
- 13 tests: registration, all movement types, stock derivation, JE posting, history

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/app/api/inventory/items/[id]/route.ts

@@ -0,0 +1,34 @@
+/**
+ * GET /api/inventory/items/[id] — Get inventory item detail with recent movements
+ */
+import { NextRequest, NextResponse } from "next/server";
+import { withPermission } from "@/lib/middleware/authorize";
+import { withTenantContext } from "@/lib/prisma-tenant";
+import { InventoryService } from "@/lib/services/inventory-service";
+
+export function GET(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  return withPermission("read", "Inventory")(
+    async (_req: NextRequest, { user }) => {
+      if (!user.tenantId) {
+        return NextResponse.json(
+          { error: "No tenant context — super-admins must use the admin API" },
+          { status: 400 }
+        );
+      }
+
+      const { id } = await params;
+      const tenantPrisma = withTenantContext(user.tenantId);
+
+      try {
+        const item = await InventoryService.getItem(tenantPrisma, id);
+        if (!item) {
+          return NextResponse.json({ error: "Item not found" }, { status: 404 });
+        }
+        return NextResponse.json(item);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Failed to get item";
+        return NextResponse.json({ error: message }, { status: 500 });
+      }
+    }
+  )(req);
+}