Initial commit: UOMysticmoon backend (Express + MariaDB + JWT)

- Layered API (router -> controller -> model -> db), serverlinkr pattern
- Public / auth / admin route groups; posts, wiki, settings, users, activity models
- JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS)
- Site LIVE/MAINTENANCE mode with admin preview bypass
- Dual file+console logging (info/warn/error/debug) + HTTP access logs
- Docker Compose (app + MariaDB), schema.sql + seed, .env.example
- Verified end-to-end against MariaDB (27/27 smoke checks)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,45 @@
+# ─── UOMysticmoon — root environment (used by docker-compose) ───
+# Copy to .env and fill in. NEVER commit the real .env.
+
+# App
+NODE_ENV=production
+PORT=3000
+UPLOAD_DIR=/app/uploads
+# Logging — written to BOTH the console and a log file.
+LOG_LEVEL=info          # console verbosity: error | warn | info | debug
+FILE_LOG_LEVEL=debug    # file verbosity (keep a full record on disk)
+LOG_TO_FILE=true        # set false for console-only
+LOG_DIR=/app/logs       # log directory inside the container (bind-mounted to ./logs)
+LOG_FILE=app.log
+
+# Database (the values here are shared by the `db` and `app` containers)
+DB_HOST=db
+DB_PORT=3306
+DB_NAME=uomysticmoon
+DB_USER=uomm
+DB_PASSWORD=change-me-db-password
+DB_ROOT_PASSWORD=change-me-root-password
+
+# Auth
+JWT_SECRET=change-me-to-a-long-random-string
+JWT_EXPIRES_IN=1d
+# auto = Secure cookie only when the request arrives over HTTPS (Pangolin).
+# Leave as auto so login works both via the LAN IP (HTTP) and the proxy (HTTPS).
+COOKIE_SECURE=auto
+COOKIE_NAME=uomm_token
+
+# First admin bootstrap — created only if no users exist yet.
+# Set, run once, then you can blank these out.
+ADMIN_USERNAME=
+ADMIN_PASSWORD=
+
+# Email (optional). If SMTP_HOST is blank, the contact endpoint tells the
+# client to fall back to a mailto: link instead.
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+CONTACT_TO=UOMysticmoon@gmail.com
+
+# CORS — only needed for local dev when the Vite dev server is a different origin.
+CLIENT_ORIGIN=http://localhost:5173