Fix functions deploy broken by the express 5 upgrade

[rzueger]

Problem

The lszm_test functions deploy fails (run 438), dying 8 seconds into firebase deploy --only functions.

15c5091 ("Update dependencies within existing version ranges") bumped firebase-functions 7.2.5 → 7.3.2, which pulled express 4.22.2 → 5.2.1 in transitively. Express 5 uses path-to-regexp v8, which dropped the optional-group route syntax all six API routes relied on:

TypeError: Unexpected ( at index 0: (/api)?/aerodrome/status
    at pathToRegexp (node_modules/path-to-regexp/dist/index.js:274:5)

functions/index.js throws on load, so the deploy fails during function discovery. Only lszm surfaced it because it was the one environment approved on that run — the other functions jobs were cancelled, not passing.

The weakness underneath: express was required in functions/api/index.js but never declared in functions/package.json, so it rode along on whatever firebase-functions happened to hoist. That is how a major version bump slipped in unnoticed.

Changes

• functions/package.json — declare "express": "^5.2.1" as a direct dependency; lockfile regenerated.
• functions/api/index.js — six routes converted from '(/api)?/x' to ['/x', '/api/x'], which express 5 still supports.

Verification

• Clean npm ci + require('./index.js') → loads, 31 exports (what deploy discovery does).
• Route smoke test on express 5: /customs/invoices → 200, /api/customs/invoices → 200, unknown path → 404.
• npm run test:functions → 443 passed, 39 suites.
• npm run typecheck → clean.
• npm test → 2494 passed, 6 failed in src/components/MovementList/Predicates.spec.ts. Those fail identically on unmodified develop — pre-existing and unrelated (date-boundary/timezone comparisons), not addressed here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DwLp35iqaMTEhtqTcyu4EN