Initial implementation of Bluetooth toy control app

Next.js app with a browser-side buttplug/buttplug-wasm control layer
(server never touches real-time device commands), SQLite storage via
Drizzle, single-secret auth, recordings/replay with device remapping,
a usage stats dashboard, Docker deployment, and Gitea CI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8WkFF5ppURBAB918593Eb

.env.example

@@ -0,0 +1,24 @@
+# The shared secret users type into the login form. Compared with a
+# constant-time check - not stored as a hash since it's a single app-wide
+# gate, not a per-user credential store.
+ACCESS_PASSWORD=change-me
+
+# Signing key for the session JWT. Deliberately separate from
+# ACCESS_PASSWORD - reusing the login password as the signing key would let a
+# JWT-signing weakness leak the login secret itself. Generate one with:
+#   openssl rand -base64 32
+AUTH_SECRET=change-me-too-at-least-16-chars
+
+# Path to the SQLite database file. In Docker this should point inside the
+# ./data bind mount so it survives container restarts.
+DATABASE_PATH=./data/app.db
+
+# debug | info | warn | error (default: debug in development, info in production)
+LOG_LEVEL=info
+
+# --- Compose-level only ---
+# Docker Compose reads this same file for ${...} substitution in
+# docker-compose.yml (Traefik labels, network name) - these aren't read by
+# the app itself.
+TRAEFIK_HOST=sexy.example.com
+NETWORK_NAME=compose_network