feat(api): add backend api with express and sqlite

backend/.dockerignore

@@ -0,0 +1,3 @@
+node_modules
+*.log
+.git

backend/Dockerfile

@@ -0,0 +1,18 @@
+FROM node:20-slim
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
+
+COPY package*.json ./
+RUN npm install --omit=dev --ignore-scripts && \
+    cd node_modules/better-sqlite3 && \
+    npm run build-release
+
+COPY . .
+
+RUN mkdir -p /app/data
+
+EXPOSE 3001
+
+CMD ["node", "server.js"]

backend/middleware/auth.js

@@ -0,0 +1,41 @@
+const tokens = new Set();
+
+export function registerToken(token) {
+  tokens.add(token);
+}
+
+export function revokeToken(token) {
+  tokens.delete(token);
+}
+
+export function isValidToken(token) {
+  return tokens.has(token);
+}
+
+export function authMiddleware(req, res, next) {
+  if (process.env.USE_KEYCLOAK === 'true') {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return res.status(401).json({ error: 'Missing bearer token' });
+    }
+    // In Keycloak mode, token validation would happen here
+    // For now, we accept any bearer token (real Keycloak integration would verify JWT)
+    return next();
+  }
+  
+  const authHeader = req.headers.authorization;
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'Missing bearer token' });
+  }
+  
+  const token = authHeader.slice(7);
+  if (!isValidToken(token)) {
+    return res.status(401).json({ error: 'Invalid token' });
+  }
+  
+  next();
+}
+
+export function optionalAuth(req, res, next) {
+  next();
+}

backend/vitest.config.js

@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    globals: true,
+  },
+})