Fix misplaced error-handler middleware and consolidate duplicate middleware directories

[grantfox-development]

Problem

There are two related issues in how middleware is organized and wired into the app.

1. Error handler is registered before the routes — so it never catches route errors

In src/index.ts, the error-handling middleware is mounted before any of the application routes are registered:

// src/index.ts (around lines 8 and 41)
import { errorHandler } from "./middlewares/errorHandler";
...
app.use(
  (err, req, res, next) => {
    errorHandler(err, req, res, next);
  }
);

// routes (authRoutes, userRoutes, nftRoutes, etc.) are mounted AFTER this line

Express invokes error-handling middleware only for errors thrown by handlers/middleware that were registered before it. Because the error handler is installed before the routes, it will never receive errors from any route handler. Errors fall through to Express's default handler instead, leaking stack traces and bypassing the project's standardized error response.

2. Duplicate middleware directories: src/middleware/ vs src/middlewares/

The repo has both:

• src/middleware/ — contains authMiddleware.ts, rateLimitMiddleware.ts
• src/middlewares/ — contains errorHandler.ts

This is inconsistent, confusing for contributors, and makes imports unpredictable.

Proposed Solution

1. Consolidate both directories into a single src/middleware/ (singular). Move errorHandler.ts into it and update all imports.
2. Reorder middleware registration in src/index.ts so the order is:
   1. body parsers (express.json)
   2. CORS
   3. rate limiting
   4. routes
   5. 404 handler
   6. error handler (last)
3. Remove the inline arrow-function wrapper in index.ts and pass the imported errorHandler directly to app.use(...) (the wrapper currently masks Express's 4-arg signature detection in some setups).
4. Add a smoke test in tests/ that throws inside a route handler (next(new Error("boom"))) and asserts the response shape comes from errorHandler, not Express's default.
5. Document the canonical middleware order in CONTRIBUTING.md.

Acceptance Criteria

• Only one middleware directory exists (src/middleware/); src/middlewares/ is deleted.
• All imports updated; tsc --noEmit and existing tests pass.
• In src/index.ts, the error handler is the last app.use(...) call, registered after all routes and a 404 fallback.
• errorHandler is passed directly to app.use (no anonymous wrapper).
• New test verifies a thrown error in a route reaches errorHandler and returns the project's standardized error JSON.
• CONTRIBUTING.md documents the middleware-order convention.

Out of Scope

• Refactoring the contents of errorHandler itself (logging, error classes) — a separate effort.
• Adding new middleware.

Suggested Labels

bug, code-quality, good first issue