feat(api): add backend api with express and sqlite

backend/middleware/auth.js

@@ -0,0 +1,41 @@
+const tokens = new Set();
+
+export function registerToken(token) {
+  tokens.add(token);
+}
+
+export function revokeToken(token) {
+  tokens.delete(token);
+}
+
+export function isValidToken(token) {
+  return tokens.has(token);
+}
+
+export function authMiddleware(req, res, next) {
+  if (process.env.USE_KEYCLOAK === 'true') {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ')) {
+      return res.status(401).json({ error: 'Missing bearer token' });
+    }
+    // In Keycloak mode, token validation would happen here
+    // For now, we accept any bearer token (real Keycloak integration would verify JWT)
+    return next();
+  }
+  
+  const authHeader = req.headers.authorization;
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    return res.status(401).json({ error: 'Missing bearer token' });
+  }
+  
+  const token = authHeader.slice(7);
+  if (!isValidToken(token)) {
+    return res.status(401).json({ error: 'Invalid token' });
+  }
+  
+  next();
+}
+
+export function optionalAuth(req, res, next) {
+  next();
+}