Add server, routes, views, CLI, CSS, and integration tests

- Server factory with Fastify plugins (JWT, cookie, multipart, formbody, static)
- Auth middleware: requireAuth preHandler (401 for API, redirect for pages)
- Auth API routes: POST /api/v1/auth/login, POST /api/v1/auth/logout
- File API routes: GET/POST /api/v1/files, DELETE /api/v1/files/:id
- Page routes: /, /login, /logout, /upload, /files, /files/:id/delete, /f/:id, /f/:id/raw
- HTML views: layout, login, upload, file-list, file-view, not-found
- CLI register-user script
- public/style.css dark theme
- Test helpers: createTestApp, loginAs, buildMultipart
- Integration tests for auth API, file API, and page routes (51 tests passing)
- Update CLAUDE.md with red/green TDD and commit instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/views/file-view.ts

@@ -0,0 +1,27 @@
+import { layout, escHtml } from './layout.ts';
+import type { FileRow } from '../db/files.ts';
+
+export function fileViewPage(file: FileRow): string {
+  const rawUrl = escHtml(`/f/${file.id}/raw`);
+  const safeName = escHtml(file.original_name);
+  const actions = `
+    <div class="file-actions">
+      <a href="${rawUrl}" download="${safeName}" class="btn">Download</a>
+      <a href="${rawUrl}" target="_blank" class="btn">Open</a>
+    </div>`;
+
+  let media = '';
+  if (file.mime_type.startsWith('video/')) {
+    media = `<video controls src="${rawUrl}" preload="metadata"></video>`;
+  } else if (file.mime_type.startsWith('audio/')) {
+    media = `<audio controls src="${rawUrl}" preload="metadata"></audio>`;
+  }
+
+  return layout(file.original_name, `
+    <div class="file-view">
+      <h1>${safeName}</h1>
+      ${media}
+      ${actions}
+    </div>
+  `);
+}