Add server, routes, views, CLI, CSS, and integration tests

- Server factory with Fastify plugins (JWT, cookie, multipart, formbody, static)
- Auth middleware: requireAuth preHandler (401 for API, redirect for pages)
- Auth API routes: POST /api/v1/auth/login, POST /api/v1/auth/logout
- File API routes: GET/POST /api/v1/files, DELETE /api/v1/files/:id
- Page routes: /, /login, /logout, /upload, /files, /files/:id/delete, /f/:id, /f/:id/raw
- HTML views: layout, login, upload, file-list, file-view, not-found
- CLI register-user script
- public/style.css dark theme
- Test helpers: createTestApp, loginAs, buildMultipart
- Integration tests for auth API, file API, and page routes (51 tests passing)
- Update CLAUDE.md with red/green TDD and commit instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/helpers/setup.ts

@@ -0,0 +1,88 @@
+import { mkdtempSync, rmSync, mkdirSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { initDb } from '../../src/db/schema.ts';
+import { createServer } from '../../src/server.ts';
+import type { Config } from '../../src/config.ts';
+import type Database from 'better-sqlite3';
+import type { FastifyInstance } from 'fastify';
+
+export async function loginAs(app: FastifyInstance, username: string, password: string): Promise<string> {
+  const res = await app.inject({
+    method: 'POST',
+    url: '/api/v1/auth/login',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ username, password }),
+  });
+  const cookie = res.headers['set-cookie'] as string;
+  return cookie.split(';')[0].replace('token=', '');
+}
+
+export interface MultipartFile {
+  filename: string;
+  contentType: string;
+  data: Buffer;
+}
+
+export function buildMultipart(files: Record<string, MultipartFile>): { payload: Buffer; headers: Record<string, string> } {
+  const boundary = '----TestBoundary' + Math.random().toString(36).slice(2);
+  const parts: Buffer[] = [];
+
+  for (const [fieldname, file] of Object.entries(files)) {
+    parts.push(Buffer.from(
+      `--${boundary}\r\n` +
+      `Content-Disposition: form-data; name="${fieldname}"; filename="${file.filename}"\r\n` +
+      `Content-Type: ${file.contentType}\r\n\r\n`,
+    ));
+    parts.push(file.data);
+    parts.push(Buffer.from('\r\n'));
+  }
+  parts.push(Buffer.from(`--${boundary}--\r\n`));
+
+  return {
+    payload: Buffer.concat(parts),
+    headers: { 'content-type': `multipart/form-data; boundary=${boundary}` },
+  };
+}
+
+export interface TestContext {
+  app: FastifyInstance;
+  db: Database.Database;
+  uploadDir: string;
+  logFile: string;
+  cleanup: () => void;
+}
+
+export function createTestApp(): TestContext {
+  const tmpDir = mkdtempSync(join(tmpdir(), 'nanodrop-int-'));
+  const uploadDir = join(tmpDir, 'uploads');
+  const logFile = join(tmpDir, 'test.log');
+
+  mkdirSync(uploadDir, { recursive: true });
+
+  const db = initDb(':memory:');
+
+  const config: Config = {
+    port: 0,
+    host: '127.0.0.1',
+    jwtSecret: 'test-secret-key',
+    jwtExpiry: '1h',
+    dbPath: ':memory:',
+    uploadDir,
+    logFile,
+    maxFileSize: 10 * 1024 * 1024,
+    baseUrl: 'http://localhost:3000',
+    cookieSecure: false,
+    trustProxy: false,
+  };
+
+  const app = createServer({ config, db });
+
+  return {
+    app,
+    db,
+    uploadDir,
+    logFile,
+    cleanup: () => rmSync(tmpDir, { recursive: true, force: true }),
+  };
+}