#8 Tier-1

Summary by cubic

Adds JWT + API key auth, per‑IP rate limiting with KV caching, R2 media uploads, and a motion‑polished SPA with create session, virtualised history, offline/PWA, and scorecard export.

• New Features

  • API: /auth/token (JWT from API key), API key list/create/revoke, JWT or x-oche-owner support, structured JSON logs with X-Trace-Id, deep GET /health?deep=1, OpenAPI updates + /openapi.json, per‑IP RateLimiter Durable Object, KV‑cached GET /sessions (60s TTL, X-Cache), and media upload to R2 with stricter MIME/size policy.
  • Web: page‑load motion (AnimatedOutlet, skeletons, TabStrip), Create Session (/sessions/new) with required tooltips, MediaUpload with progress/cancel, game guides and field tooltips single‑sourced, virtualised History list with responsive posters, animated score display, owner switcher + API key UI (/settings/keys), PWA read‑only offline with query persistence and OfflineBanner, i18n (en), scorecard export, theme toggle, and an API docs page.

• Migration

  • Migrate Durable Objects to add RateLimiter and create/bind a KV namespace to CACHE in wrangler.toml.
  • Set secrets and envs: OCHE_JWT_SECRET, MEDIA_SIGNING_SECRET, VITE_API_BASE_STAGING, VITE_API_BASE_PROD (update .dev.vars and CI).
  • Use new build/deploy scripts: build:web:staging / build:web:prod; staging full pipeline via npm run deploy:staging:full.
  • Local dev: npm run setup, npm run setup:dev-vars:sync, npm run db:prepare, then npm run dev.