#7 Tier-2

Summary by cubic

Adds JWT auth and API key management, KV-cached session lists, and DO-based rate limiting to harden the API. The SPA gets media upload, polished page-load motion with skeletons, required field tooltips, game guides, PWA offline read-only, i18n, and scorecard export.

• New Features

  • Auth & keys: POST /auth/token (exchange API key → short‑lived JWT); SPA AuthProvider + owner switcher; API key UI at /settings/keys; OpenAPI updated with BearerJwt.
  • Scale & reliability: RateLimiter Durable Object (per‑IP), KV cache for GET /sessions (HTTP max‑age 15s; KV 60s; X-Cache), structured JSON logs with X-Trace-Id, deep readiness GET /health?deep=1.
  • Media: /media/upload to R2 with progress/cancel (MediaUpload); PATCH supports videoUrl, videoPoster, hlsUrl, and player photos; added HLS MIME types.
  • Motion & UX: route transitions via AnimatedOutlet, destination‑aware skeletons, sliding TabStrip; required tooltips via TextField/SelectField/FileField; single‑source game guides (game-guides.ts) shown with GameGuideCard.
  • Extras: PWA with query persistence and offline banner; i18n via react-i18next (en); scorecard export to print‑ready HTML; static API docs served from /openapi.json and /docs/.

• Migration

  • Set OCHE_JWT_SECRET in API env and sync dev vars (npm run setup:dev-vars:sync); optionally set VITE_PLAUSIBLE_DOMAIN or VITE_CF_WEB_ANALYTICS_TOKEN.
  • From apps/api: create KV namespace for CACHE and add IDs to wrangler.toml; apply the RateLimiter DO migration (tag v2) and redeploy.
  • Rebuild the SPA to pick up PWA/i18n and new routes; no breaking changes to existing endpoints.