Initial commit: UOMysticmoon backend (Express + MariaDB + JWT)

- Layered API (router -> controller -> model -> db), serverlinkr pattern
- Public / auth / admin route groups; posts, wiki, settings, users, activity models
- JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS)
- Site LIVE/MAINTENANCE mode with admin preview bypass
- Dual file+console logging (info/warn/error/debug) + HTTP access logs
- Docker Compose (app + MariaDB), schema.sql + seed, .env.example
- Verified end-to-end against MariaDB (27/27 smoke checks)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -0,0 +1,28 @@
+FROM node:20-alpine
+
+WORKDIR /app
+
+# Install server deps first for better layer caching (production only).
+COPY server/package*.json server/
+RUN npm install --prefix server --omit=dev
+
+# Copy the rest of the repo. .dockerignore keeps node_modules/.env/_reference out,
+# so the server deps installed above are preserved.
+COPY . .
+
+# Build the client if it is present (added in the frontend phase). Until then the
+# server runs API-only and serves a placeholder at /.
+RUN if [ -f client/package.json ]; then \
+      npm install --prefix client && npm run build --prefix client; \
+    else \
+      echo "No client/ present — building server-only image"; \
+    fi
+
+# Persistent uploads + logs live on mounted volumes.
+RUN mkdir -p /app/uploads /app/logs && chown -R node:node /app/uploads /app/logs
+
+USER node
+
+EXPOSE 3000
+
+CMD ["npm", "start", "--prefix", "server"]