First commit, phased 1 and 2 created but untested

src/routes/character.js

@@ -0,0 +1,51 @@
+// Character routes: POST /api/character (create), GET /api/character (profile).
+const zod = require('zod');
+const { AppError } = require('../utils/errors');
+const { requireAuth } = require('../middleware/session');
+const { createCharacter, getCharacterProfile } = require('../services/characterService');
+const { CLASS_KEYS } = require('../game/classes');
+
+// Validation schemas
+const createSchema = zod.strictObject({
+  name: zod.string().min(3).max(16).regex(/^[A-Za-z0-9 ']+$/).trim(),
+  class: zod.enum(CLASS_KEYS),
+});
+
+function wrap(fn) {
+  return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
+}
+
+async function handleCreate(req, res) {
+  const parsed = createSchema.safeParse(req.body);
+  if (!parsed.success) {
+    throw new AppError('VALIDATION_ERROR', 'Request validation failed.', 400);
+  }
+
+  const { name, class: classKey } = parsed.data;
+  const userId = req.session.userId;
+
+  const result = createCharacter(userId, name, classKey);
+
+  res.status(201).json({
+    ok: true,
+    data: { character: { id: result.id, name, class: classKey } },
+  });
+}
+
+async function handleGet(req, res) {
+  const userId = req.session.userId;
+  const profile = getCharacterProfile(userId);
+
+  if (!profile) {
+    return res.json({ ok: true, data: null });
+  }
+
+  res.json({ ok: true, data: profile });
+}
+
+module.exports = {
+  routes: {
+    postCharacter: wrap(handleCreate),
+    getCharacter: wrap(handleGet),
+  },
+};