medication tracking started

docs/API_REFERENCE.md

@@ -75,6 +75,7 @@ Endpoints that accept either browser session tokens or integration tokens:
 - `/api/birds`
 - `/api/birds/:birdId/weights`
 - `/api/birds/:birdId/vet-visits`
+- `/api/birds/:birdId/medications`
 
 Read-only integration tokens can call read endpoints, but cannot call write endpoints.
 
@@ -245,6 +246,22 @@ Role requirements are called out per endpoint below. If the signed-in member lac
 }
 ```
 
+### Medication
+
+```json
+{
+  "id": "uuid",
+  "birdId": "uuid",
+  "name": "Meloxicam",
+  "dosage": "0.05 mL",
+  "frequency": "Every 12 hours",
+  "route": "Oral",
+  "startDate": "2026-04-14",
+  "endDate": null,
+  "notes": "Give with food"
+}
+```
+
 ## Common Validation Rules
 
 - Dates use `YYYY-MM-DD`
@@ -885,6 +902,59 @@ Possible errors:
 
 - `404` if the bird does not exist in the active workspace
 
+### Medications
+
+#### `GET /api/birds/:birdId/medications`
+
+Requires auth. Lists medication records for a bird in the active workspace.
+
+Response `200`:
+
+```json
+{
+  "medications": []
+}
+```
+
+#### `POST /api/birds/:birdId/medications`
+
+Requires auth with write access and role `owner`, `assistant`, or `caregiver`. Creates a medication record.
+
+Request body:
+
+```json
+{
+  "name": "Meloxicam",
+  "dosage": "0.05 mL",
+  "frequency": "Every 12 hours",
+  "route": "Oral",
+  "startDate": "2026-04-14",
+  "endDate": "",
+  "notes": "Give with food"
+}
+```
+
+Response `201`:
+
+```json
+{
+  "medication": {}
+}
+```
+
+#### `PUT /api/birds/:birdId/medications/:medicationId`
+
+Requires auth with write access and role `owner`, `assistant`, or `caregiver`. Updates a medication record.
+
+#### `DELETE /api/birds/:birdId/medications/:medicationId`
+
+Requires auth with write access and role `owner`, `assistant`, or `caregiver`. Deletes a medication record.
+
+Possible errors:
+
+- `400` if `endDate` is before `startDate`
+- `404` if the bird or medication does not exist in the active workspace
+
 ### Integration Tokens
 
 These endpoints are for browser-session users managing their own automation tokens. They are not accessible with an integration token itself.