#1 added deploy:all

Summary by cubic

Refactors the API and web app to support signed media, paginated sessions, and real-time updates, and adds a streamlined local dev setup. Includes OpenAPI docs, stronger middleware, and comprehensive tests.

• New Features

  • Media: POST /media/upload with MIME/size validation, immutable hashed R2 keys, signed fetch URLs, byte-range reads; HMAC via MEDIA_SIGNING_SECRET.
  • Sessions: Modular Hono app with GET/POST/PATCH /sessions, cursor pagination, SessionRoom Durable Object broadcasts, and OpenAPI 3.1 spec.
  • Security: CSP, stricter CORS using APP_ORIGIN, rate limiting, and JSON body size limits.
  • DB/RLS: withPrincipal sets role oche_app and owner context; migration grants to enable SET ROLE.
  • Web: Lazy-loaded routes, PlayerAvatar, improved Overview/History/Detail, useLiveSession exposes connected, WS URL accepts ?key=..., Vite envDir at repo root.
  • Tooling: Local R2 binding, scripts/wrangler-dev.mjs, env/key helpers (env-setup, generate-keys, setup, with-env), doctor checks, and OpenAPI endpoint.
  • Tests: Unit tests for media, pagination, principal, sessions; Playwright e2e with @axe-core/playwright a11y checks and seeded global setup.

• Migration

  • Run npm run setup to create .env and apps/api/.dev.vars from templates.
  • Set DATABASE_URL (Neon) and MEDIA_SIGNING_SECRET in .env; ensure APP_ORIGIN and VITE_API_BASE match local defaults.
  • Generate local API keys: npm run keys:generate (writes .oche-keys.json and syncs .dev.vars).
  • Apply DB changes: node scripts/run-steps.mjs db:migrate db:force-rls db:seed.
  • Start dev: npm run dev (wrangler API + web). For staging/prod, set Wrangler vars/secrets, R2 buckets, and Hyperdrive IDs.