Modernize the API runtime with Prisma 7 and automated updates

[maotora]

Summary

• upgrade the project to Prisma 7 with a generated ESM client, @prisma/adapter-pg, and a single shared Prisma runtime
• rebuild the database setup around a reproducible baseline migration and deterministic seed data for local development and CI
• preserve public API compatibility by keeping both /v1 and /api, while cleaning up routes, request validation, search safety, logging, and cache behavior
• add GitHub automation with CI validation and Dependabot update PRs

Key Changes

• move the runtime to Node >=20.19.0, ESM, modern TypeScript config, flat ESLint config, and updated package scripts
• replace duplicate Prisma client creation with a shared singleton in src/db/prisma.ts
• migrate Prisma generation to prisma-client output under src/generated/prisma
• replace the old migration history with a fresh baseline migration that recreates the schema plus the search_vector trigger-backed full-text index support
• add deterministic seed data in prisma/seed.ts so tests and CI do not depend on an external pre-populated database
• parameterize the search query to remove $queryRawUnsafe
• mount the same router under both /v1 and /api, keeping /v1 canonical and /api as a compatibility alias
• add collection filters for countryId, regionCode, districtCode, and wardCode
• add request IDs, structured request logging, cache headers, Swagger/OpenAPI output, and updated README guidance
• add .github/workflows/ci.yml and .github/dependabot.yml

Validation

• pnpm build:ci
• pnpm build
• pnpm openapi:json
• DATABASE_URL=postgresql://postgres@localhost:5432/locations_api NODE_ENV=test pnpm test:ci

Notes

• public response envelopes remain unchanged: { data }, { data, pagination }, and { error }
• /v1 is the canonical base path going forward, but /api remains available for compatibility
• the main runtime-level change for maintainers is the new Node 20.19.0+ minimum and the Prisma 7 ESM client generation flow

[AnoRebel]

Working on it, fixing the gaps.

[AnoRebel]

Code review complete — all issues resolved, CI green.

Review findings:

• SQL injection concern was a false positive — Prisma.sql tagged templates auto-parameterize all interpolated values
• Tests already cover /v1 and /api paths, collection filters, search with special chars, compatibility headers, and Prisma singleton behavior

Fixes applied (3 commits):

1. Search query hardening: null-byte stripping + CTE refactor so plainto_tsquery runs once
2. ESLint no-unsafe-call fix: wrapped q with String() before .replace()
3. Restored as const on mode: 'insensitive' for Prisma QueryMode type compatibility

Local verification: lint ✅ typecheck ✅ 20/20 tests ✅
CI verification: Node 20.19.0 ✅ Node 22 ✅

[maotora]

@AnoRebel thanks!