docs(copilot): add Copilot instructions for The Collective Hub

- Add comprehensive project overview and core philosophy
- Document file structure reference for the codebase
- Create key files reference table for task-specific guidance
- Include multi-tenant guidelines and site resolution flow

.github/prompts/generate-api-endpoint.prompt.md

@@ -0,0 +1,67 @@
+---
+description: 'Scaffold a new SvelteKit API endpoint (+server.ts) for The Collective Hub. Generates route handler with auth, site scoping, and validation patterns.'
+agent: 'agent'
+---
+
+Scaffold a new API endpoint at `api/{resource}/` for The Collective Hub.
+
+Follow all conventions in:
+- [api-route-patterns.instructions.md](.github/instructions/api-route-patterns.instructions.md)
+- [auth-and-roles.instructions.md](.github/instructions/auth-and-roles.instructions.md)
+- [server-ts.instructions.md](.github/instructions/server-ts.instructions.md)
+
+## What to Create
+
+### `+server.ts`
+
+Determine the HTTP methods needed (GET, POST, PUT, PATCH, DELETE) based on the resource.
+
+```ts
+import { json } from '@sveltejs/kit';
+import { db } from '$lib/server/db';
+import { eq, and } from 'drizzle-orm';
+import { /* yourTable */ } from '$lib/server/db/schema';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ locals, url }) => {
+    if (!locals.user) {
+        return json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const siteId = locals.site.id;
+
+    const items = await db
+        .select()
+        .from(/* yourTable */)
+        .where(eq(/* yourTable */.siteId, siteId))
+        .orderBy(/* yourTable */.createdAt);
+
+    return json({ data: items });
+};
+
+export const POST: RequestHandler = async ({ locals, request }) => {
+    if (!locals.user) {
+        return json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
+    const body = await request.json();
+    // Validate body...
+
+    const [created] = await db
+        .insert(/* yourTable */)
+        .values({
+            siteId: locals.site.id,
+            // ... validated fields
+        })
+        .returning();
+
+    return json({ data: created }, { status: 201 });
+};
+```
+
+## Notes
+
+- Always check `locals.user` before accessing `locals.site`
+- Always filter queries by `locals.site.id`
+- Return appropriate HTTP status codes (200, 201, 400, 401, 403, 404, 500)
+- For file uploads, use multipart form data via `request.formData()` instead of `request.json()`