Rebuild on Angular 22 + ASP.NET Core 10, containerised

The 2018 stack (Angular 5.2 / CLI 1.7, PHP, MySQL) had not been touched since
July 2018. Rebuilt rather than upgraded in place: the frontend was 17 major
versions behind, and of ~16,700 lines of PHP only ~150 were application logic —
the rest was four near-identical vendored copies of php-crud-api plus
class.upload.php.

Backend — ASP.NET Core 10, EF Core, SQLite
  * ASP.NET Core Identity (PBKDF2) + JWT bearer auth
  * Clean REST API replacing php-crud-api's filter[]/transform query syntax
  * Box art uploads re-encoded to WebP via SkiaSharp
  * Imports the 105 games recovered from the 2018 dump on first run

Frontend — Angular 22, zoneless, signals, Material 22
  * Standalone components, lazy routes, functional guards and interceptor
  * Vitest replaces Karma/Jasmine; fonts and icons bundled, no CDN calls
  * No provideAnimations: @angular/animations is deprecated in v22 and
    Material no longer depends on it (pinned by a test)

Docker
  * Multi-stage builds for both services, non-root at runtime
  * nginx serves the SPA and reverse-proxies the API, so everything is
    same-origin; one volume holds the database, uploads and DP keys

Security issues in the old code, not carried across:
  * Two endpoints exposed unauthenticated CRUD over every table
  * The client chose whose rows to read (filter[]=userId,eq,N); ownership now
    comes from the JWT subject server-side
  * Login was hardcoded to a single username
  * crypt() with one global salt, silently truncating passwords to 8 chars
  * JWT secret was the literal string "testing", tokens never expired
  * Token travelled in the query string rather than a header
  * Uploads were anonymous with the path built from the client filename
  * Access-Control-Allow-Origin: *

The live MySQL password committed in 2018 remains in git history and must be
rotated independently of this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/src/LudosData.Api/Domain/Game.cs

@@ -0,0 +1,60 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace LudosData.Api.Domain;
+
+/// <summary>
+/// A single entry in a user's game library. Mirrors the columns of the original
+/// MySQL `games` table so the 2018 dump imports without transformation, with the
+/// addition of ownership and audit fields.
+/// </summary>
+public class Game
+{
+    public int Id { get; set; }
+
+    [Required]
+    [MaxLength(200)]
+    public string Title { get; set; } = string.Empty;
+
+    /// <summary>Console/platform the game runs on, e.g. "SNES", "PS2".</summary>
+    [MaxLength(50)]
+    public string? System { get; set; }
+
+    [MaxLength(50)]
+    public string? Genre { get; set; }
+
+    /// <summary>
+    /// Release year. Kept as a string rather than an int: the original column was
+    /// varchar(50) and holds values like "" and "1996" — some entries were never
+    /// filled in, and a few real-world cases want ranges.
+    /// </summary>
+    [MaxLength(50)]
+    public string? Year { get; set; }
+
+    [MaxLength(100)]
+    public string? Developer { get; set; }
+
+    [MaxLength(100)]
+    public string? Publisher { get; set; }
+
+    /// <summary>Filename of the uploaded box art, relative to the owner's upload folder.</summary>
+    [MaxLength(200)]
+    public string? Art { get; set; }
+
+    public string? Description { get; set; }
+
+    public bool Own { get; set; }
+    public bool Dumped { get; set; }
+    public bool Played { get; set; }
+    public bool Finished { get; set; }
+
+    /// <summary>
+    /// Owning user. Every query is filtered on this server-side, from the JWT subject —
+    /// it is never accepted from the client.
+    /// </summary>
+    [Required]
+    public string OwnerId { get; set; } = string.Empty;
+    public AppUser? Owner { get; set; }
+
+    public DateTimeOffset CreatedAt { get; set; }
+    public DateTimeOffset UpdatedAt { get; set; }
+}