Rebuild on Angular 22 + ASP.NET Core 10, containerised

The 2018 stack (Angular 5.2 / CLI 1.7, PHP, MySQL) had not been touched since
July 2018. Rebuilt rather than upgraded in place: the frontend was 17 major
versions behind, and of ~16,700 lines of PHP only ~150 were application logic —
the rest was four near-identical vendored copies of php-crud-api plus
class.upload.php.

Backend — ASP.NET Core 10, EF Core, SQLite
  * ASP.NET Core Identity (PBKDF2) + JWT bearer auth
  * Clean REST API replacing php-crud-api's filter[]/transform query syntax
  * Box art uploads re-encoded to WebP via SkiaSharp
  * Imports the 105 games recovered from the 2018 dump on first run

Frontend — Angular 22, zoneless, signals, Material 22
  * Standalone components, lazy routes, functional guards and interceptor
  * Vitest replaces Karma/Jasmine; fonts and icons bundled, no CDN calls
  * No provideAnimations: @angular/animations is deprecated in v22 and
    Material no longer depends on it (pinned by a test)

Docker
  * Multi-stage builds for both services, non-root at runtime
  * nginx serves the SPA and reverse-proxies the API, so everything is
    same-origin; one volume holds the database, uploads and DP keys

Security issues in the old code, not carried across:
  * Two endpoints exposed unauthenticated CRUD over every table
  * The client chose whose rows to read (filter[]=userId,eq,N); ownership now
    comes from the JWT subject server-side
  * Login was hardcoded to a single username
  * crypt() with one global salt, silently truncating passwords to 8 chars
  * JWT secret was the literal string "testing", tokens never expired
  * Token travelled in the query string rather than a header
  * Uploads were anonymous with the path built from the client filename
  * Access-Control-Allow-Origin: *

The live MySQL password committed in 2018 remains in git history and must be
rotated independently of this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,48 +1,39 @@
-# See http://help.github.com/ignore-files/ for more about ignoring files.
+# Secrets — never commit. The 2018 version of this project committed live
+# database credentials, which is why they now have to be treated as compromised.
+.env
+*.env
+!.env.example
 
-# compiled output
-/dist
-/dist-server
-/tmp
-/out-tsc
+# Runtime state
+data/
+uploads/
+*.db
+*.db-shm
+*.db-wal
 
-# dependencies
-/node_modules
+# --- Frontend ---
+node_modules/
+frontend/dist/
+frontend/.angular/
+npm-debug.log*
+yarn-error.log*
+testem.log
 
-# IDEs and editors
-/.idea
+# --- Backend ---
+[Bb]in/
+[Oo]bj/
+*.user
+.vs/
+
+# --- Editors / OS ---
+.idea/
 .project
 .classpath
-.c9/
-*.launch
-.settings/
 *.sublime-workspace
-
-# IDE - VSCode
 .vscode/*
-!.vscode/settings.json
-!.vscode/tasks.json
-!.vscode/launch.json
 !.vscode/extensions.json
-
-# misc
-/.sass-cache
-/connect.lock
-/coverage
-/libpeerconnection.log
-npm-debug.log
-testem.log
-/typings
-
-# e2e
-/e2e/*.js
-/e2e/*.map
-
-# System Files
+!.vscode/launch.json
+!.vscode/tasks.json
 .DS_Store
 Thumbs.db
-src/app/game-grid/game-grid.component.html
-src/app/game-grid/game-grid.component.html
-src/app/game-grid/game-grid.component.ts
-src/app/game-grid/game-grid.component.html
-src/app/games.service.ts
+*.swp