Bootstrap and Startup

Startup sequence

1. backend/src/server.ts imports app and resolves PORT.
2. backend/src/app.ts calls loadEnvironment() before creating Express app.
3. Middlewares are registered in this order:
   • cors()
   • express.json()
   • globalLimiter
4. Health endpoint is mounted: GET /health.
5. API routers are mounted under /api/v1 via apiRoutes(app).
6. Centralized error middleware is mounted last.

Why this order matters

• Global rate limit protects all endpoints, including auth and health-adjacent paths.
• Validation/auth errors are normalized by the shared error middleware.
• Route registration after base middleware guarantees JSON parsing and CORS are always applied.

Minimal code anchor

app.get('/health', (_req, res) => {
  res.status(200).json({ status: 'ok' });
});

Source: backend/src/app.ts.