Initial implementation of Bluetooth toy control app

Next.js app with a browser-side buttplug/buttplug-wasm control layer
(server never touches real-time device commands), SQLite storage via
Drizzle, single-secret auth, recordings/replay with device remapping,
a usage stats dashboard, Docker deployment, and Gitea CI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W8WkFF5ppURBAB918593Eb

app/api/play-sessions/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { listPlaySessions, startPlaySession } from "@/lib/db/queries/play-sessions";
+
+const deviceInputSchema = z.object({
+  slotLabel: z.string().min(1),
+  bleName: z.string().min(1),
+  deviceClass: z.string().nullish(),
+  capabilities: z.object({ outputs: z.array(z.string()), featureCount: z.number() }).optional(),
+});
+
+const bodySchema = z.object({
+  kind: z.enum(["live", "replay"]),
+  replayedRecordingId: z.number().int().positive().optional(),
+  name: z.string().min(1).optional(),
+  devices: z.array(deviceInputSchema).min(1),
+});
+
+export async function GET() {
+  const rows = await listPlaySessions();
+  return NextResponse.json({ playSessions: rows });
+}
+
+export async function POST(req: Request) {
+  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
+  if (!parsed.success) {
+    return NextResponse.json({ error: parsed.error.message }, { status: 400 });
+  }
+  const result = await startPlaySession(parsed.data);
+  return NextResponse.json(result, { status: 201 });
+}