feat: implement core server with API routing, middleware, and static file serving

task.md

@@ -1,23 +1,21 @@
-# Fix Docker Database Permissions
+# Fix Docker Database & Proxy Issues
 
 ## Context
 
-SQLite database in Docker container is read-only due to volume permissions mismatch between root and xtremuser.
-
-## Current Focus
-
-Implementation complete - ready for rebuild and deploy.
+1. SQLite database read-only error on login (permissions)
+2. Xtream proxy 401 Unauthorized errors
 
 ## Master Plan
 
-- [x] Analyze the error and identify root cause
-- [x] Create entrypoint.sh script to fix permissions at startup
-- [x] Update Dockerfile to use entrypoint script with gosu
-- [ ] Rebuild and deploy to test
+- [x] Analyze database readonly error → volume permissions mismatch
+- [x] Create `entrypoint.sh` with gosu for privilege drop
+- [x] Update `Dockerfile` to use entrypoint
+- [x] Analyze proxy 401 errors → broken mount in apiRouter
+- [x] Remove duplicate `/api/xtream` mount from `server.dart`
+- [ ] Rebuild and deploy
 
-## Progress Log
+## Changes Made
 
-- Identified `SqliteException(8): attempt to write a readonly database` error
-- Root cause: Docker volume created with different permissions than xtremuser
-- Created `entrypoint.sh` with chown fix and gosu privilege drop
-- Updated Dockerfile: added gosu, ENTRYPOINT, removed USER directive
+- `entrypoint.sh`: Fixes /app/data permissions at startup, then runs as xtremuser
+- `Dockerfile`: Added gosu, ENTRYPOINT, removed USER directive
+- `server.dart`: Removed broken /api/xtream mount that was blocking proxy