Express.js API Patterns

Description

Structure and review Express.js REST APIs for production - feature-based routers, an app factory separate from listen() for testing, middleware order (helmet, body limits, trust proxy, rate limits, routes, 404, error handler), Zod validation middleware, a custom AppError and four-argument error middleware, async errors on Express 5 vs Express 4, thin controllers over services, JWT authentication with role guards and Request type augmentation, per-route and per-key rate limiting, and one consistent JSON response shape. Use whenever the project depends on express, the user builds or refactors an Express API, adds routes, validation, auth or rate limiting, sees unhandled promise rejections or hanging requests, errors return HTML stack traces, or asks how to organize Express code.