step 8.1: done

src/app.js

@@ -9,6 +9,7 @@ const { routes: combatLogRoutes } = require('./routes/combatLog');
 const { routes: inventoryRoutes } = require('./routes/inventory');
 const { routes: shopRoutes } = require('./routes/shop');
 const { routes: expeditionRoutes } = require('./routes/expeditions');
+const { routes: leaderboardRoutes } = require('./routes/leaderboard');
 const { AppError } = require('./utils/errors');
 
 function createApp() {
@@ -72,6 +73,9 @@ function createApp() {
   app.get('/api/expeditions/active', requireAuth, expeditionRoutes.getActive);
   app.post('/api/expeditions/claim', requireAuth, expeditionRoutes.postClaim);
 
+  // Leaderboard route (require session)
+  app.get('/api/leaderboard', requireAuth, leaderboardRoutes.getLeaderboard);
+
   // Central error handler
   app.use((err, _req, res, _next) => {
     // Log stack traces server-side only