Initial implementation of Bluetooth toy control app

Next.js app with a browser-side buttplug/buttplug-wasm control layer
(server never touches real-time device commands), SQLite storage via
Drizzle, single-secret auth, recordings/replay with device remapping,
a usage stats dashboard, Docker deployment, and Gitea CI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8WkFF5ppURBAB918593Eb

app/api/auth/login/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getEnv } from "@/lib/env";
+import { timingSafeStringEqual } from "@/lib/auth/timing-safe-compare";
+import { createSessionToken, sessionCookieOptions } from "@/lib/auth/session";
+
+const bodySchema = z.object({ secret: z.string().min(1) });
+
+export async function POST(req: Request) {
+  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
+  if (!parsed.success) {
+    return NextResponse.json({ error: "secret is required" }, { status: 400 });
+  }
+
+  if (!timingSafeStringEqual(parsed.data.secret, getEnv().ACCESS_PASSWORD)) {
+    return NextResponse.json({ error: "invalid secret" }, { status: 401 });
+  }
+
+  const token = await createSessionToken();
+  const res = NextResponse.json({ ok: true });
+  res.cookies.set({ ...sessionCookieOptions, value: token });
+  return res;
+}

app/api/auth/logout/route.ts

@@ -0,0 +1,8 @@
+import { NextResponse } from "next/server";
+import { SESSION_COOKIE_NAME } from "@/lib/auth/session";
+
+export async function POST() {
+  const res = NextResponse.json({ ok: true });
+  res.cookies.delete(SESSION_COOKIE_NAME);
+  return res;
+}