Initial commit: UOMysticmoon backend (Express + MariaDB + JWT)

- Layered API (router -> controller -> model -> db), serverlinkr pattern
- Public / auth / admin route groups; posts, wiki, settings, users, activity models
- JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS)
- Site LIVE/MAINTENANCE mode with admin preview bypass
- Dual file+console logging (info/warn/error/debug) + HTTP access logs
- Docker Compose (app + MariaDB), schema.sql + seed, .env.example
- Verified end-to-end against MariaDB (27/27 smoke checks)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/router/v1/public/public.routes.js

@@ -0,0 +1,30 @@
+const express = require('express')
+const { body } = require('express-validator')
+
+const ctrl = require('./public.controller')
+const siteMode = require('../../../middleware/siteMode')
+const validate = require('../../../middleware/validate')
+const { contactLimiter } = require('../../../middleware/rateLimit')
+
+const publicRouter = express.Router()
+
+// Always available (so the client can render the maintenance page + contact).
+publicRouter.get('/settings', ctrl.getSettings)
+publicRouter.get('/status', ctrl.getStatus)
+publicRouter.post(
+  '/contact',
+  contactLimiter,
+  body('message').isString().trim().notEmpty().isLength({ max: 5000 }),
+  body('email').optional({ values: 'falsy' }).isEmail(),
+  body('name').optional({ values: 'falsy' }).isString().trim().isLength({ max: 100 }),
+  validate,
+  ctrl.contact,
+)
+
+// Content — gated by site mode (admins with a valid token bypass for preview).
+publicRouter.get('/posts/:category', siteMode, ctrl.getPosts)
+publicRouter.get('/posts/:category/:idOrSlug', siteMode, ctrl.getPost)
+publicRouter.get('/wiki', siteMode, ctrl.getWikiList)
+publicRouter.get('/wiki/:slug', siteMode, ctrl.getWikiPage)
+
+module.exports = publicRouter