feat: add connection API endpoints

Suggestions, create/confirm/hide/withdraw actions, my connections list,
and pending count for nav badge.

server/api/connections/[id]/confirm.post.js

@@ -0,0 +1,54 @@
+import mongoose from 'mongoose'
+import Connection from '../../../models/connection.js'
+import Member from '../../../models/member.js'
+import { requireAuth } from '../../../utils/auth.js'
+
+export default defineEventHandler(async (event) => {
+  const member = await requireAuth(event)
+  const memberId = member._id
+  const connectionId = getRouterParam(event, 'id')
+
+  if (!mongoose.Types.ObjectId.isValid(connectionId)) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Invalid connection ID'
+    })
+  }
+
+  const connection = await Connection.findById(connectionId)
+  if (!connection) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: 'Connection not found'
+    })
+  }
+
+  // Only the recipient can confirm
+  if (connection.recipient.toString() !== memberId.toString()) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Only the recipient can confirm a connection'
+    })
+  }
+
+  if (connection.status !== 'pending') {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Connection is not pending'
+    })
+  }
+
+  connection.status = 'confirmed'
+  connection.confirmedAt = new Date()
+  await connection.save()
+
+  // Get initiator name for activity log
+  const initiator = await Member.findById(connection.initiator)
+    .select('name')
+    .lean()
+
+  logActivity(memberId, 'connection_confirmed', { memberName: initiator?.name || 'Unknown' })
+  logActivity(connection.initiator, 'connection_confirmed', { memberName: member.name })
+
+  return { connection }
+})

server/api/connections/[id]/hide.post.js

@@ -0,0 +1,48 @@
+import mongoose from 'mongoose'
+import Connection from '../../../models/connection.js'
+import { requireAuth } from '../../../utils/auth.js'
+
+export default defineEventHandler(async (event) => {
+  const member = await requireAuth(event)
+  const memberId = member._id
+  const connectionId = getRouterParam(event, 'id')
+
+  if (!mongoose.Types.ObjectId.isValid(connectionId)) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Invalid connection ID'
+    })
+  }
+
+  const connection = await Connection.findById(connectionId)
+  if (!connection) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: 'Connection not found'
+    })
+  }
+
+  // Either party can hide
+  const isParty =
+    connection.initiator.toString() === memberId.toString() ||
+    connection.recipient.toString() === memberId.toString()
+
+  if (!isParty) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Not authorized to hide this connection'
+    })
+  }
+
+  // Add to hiddenBy if not already there
+  const alreadyHidden = connection.hiddenBy.some(
+    id => id.toString() === memberId.toString()
+  )
+
+  if (!alreadyHidden) {
+    connection.hiddenBy.push(memberId)
+    await connection.save()
+  }
+
+  return { success: true }
+})

server/api/connections/[id]/withdraw.post.js

@@ -0,0 +1,43 @@
+import mongoose from 'mongoose'
+import Connection from '../../../models/connection.js'
+import { requireAuth } from '../../../utils/auth.js'
+
+export default defineEventHandler(async (event) => {
+  const member = await requireAuth(event)
+  const memberId = member._id
+  const connectionId = getRouterParam(event, 'id')
+
+  if (!mongoose.Types.ObjectId.isValid(connectionId)) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Invalid connection ID'
+    })
+  }
+
+  const connection = await Connection.findById(connectionId)
+  if (!connection) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: 'Connection not found'
+    })
+  }
+
+  // Only the initiator can withdraw
+  if (connection.initiator.toString() !== memberId.toString()) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Only the initiator can withdraw a connection request'
+    })
+  }
+
+  if (connection.status !== 'pending') {
+    throw createError({
+      statusCode: 400,
+      statusMessage: 'Can only withdraw pending connections'
+    })
+  }
+
+  await Connection.findByIdAndDelete(connectionId)
+
+  return { success: true }
+})