feat: add comment handlers and xrpc methods

cmd/server/main.go

···
 	mux.HandleFunc("DELETE /api/docs/{rkey}", h.APIDocumentDelete)
 	mux.HandleFunc("POST /api/docs/{rkey}/invite", h.DocumentInvite)
 	mux.HandleFunc("GET /docs/{rkey}/accept", h.AcceptInvite)
+	mux.HandleFunc("POST /api/docs/{rkey}/comments", h.CommentCreate)
+	mux.HandleFunc("GET /api/docs/{rkey}/comments", h.CommentList)
 
 	// Middleware stack
 	stack := middleware.Logger(

internal/atproto/xrpc/client.go

···
 func (c *Client) PutDocument(rkey string, doc *model.Document) (string, string, error) {
 	return c.PutRecord(collectionDocument, rkey, doc)
 }
+
+const collectionComment = "com.diffdown.comment"
+
+// CreateComment creates a new comment record.
+func (c *Client) CreateComment(comment *model.Comment) (string, error) {
+	record := map[string]interface{}{
+		"$type":       "com.diffdown.comment",
+		"documentURI": comment.DocumentURI,
+		"paragraphId": comment.ParagraphID,
+		"text":        comment.Text,
+		"author":      comment.AuthorDID,
+	}
+	uri, _, err := c.CreateRecord(collectionComment, record)
+	if err != nil {
+		return "", err
+	}
+	return uri, nil
+}
+
+// ListComments fetches all comments for a document.
+func (c *Client) ListComments(documentRKey string) ([]model.Comment, error) {
+	records, _, err := c.ListRecords(c.session.DID, collectionComment, 100, "")
+	if err != nil {
+		return nil, err
+	}
+
+	var comments []model.Comment
+	for _, r := range records {
+		var comment model.Comment
+		if err := json.Unmarshal(r.Value, &comment); err != nil {
+			continue
+		}
+		comment.URI = r.URI
+		comments = append(comments, comment)
+	}
+	return comments, nil
+}

internal/handler/handler.go

···
 	http.Redirect(w, r, "/docs/"+rKey, http.StatusSeeOther)
 }
 
+// --- API: Comments ---
+
+func (h *Handler) CommentCreate(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	rKey := r.PathValue("rkey")
+	if rKey == "" {
+		http.Error(w, "Invalid document", http.StatusBadRequest)
+		return
+	}
+
+	var req struct {
+		ParagraphID string `json:"paragraphId"`
+		Text        string `json:"text"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request", http.StatusBadRequest)
+		return
+	}
+
+	if req.Text == "" {
+		http.Error(w, "Comment text required", http.StatusBadRequest)
+		return
+	}
+
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
+		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+		return
+	}
+
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+		return
+	}
+
+	comment := &model.Comment{
+		DocumentURI: fmt.Sprintf("at://%s/com.diffdown.document/%s", session.DID, rKey),
+		ParagraphID: req.ParagraphID,
+		Text:        req.Text,
+		AuthorDID:   session.DID,
+	}
+
+	uri, err := client.CreateComment(comment)
+	if err != nil {
+		log.Printf("CommentCreate: %v", err)
+		http.Error(w, "Failed to create comment", http.StatusInternalServerError)
+		return
+	}
+
+	h.jsonResponse(w, map[string]string{"uri": uri}, http.StatusCreated)
+}
+
+func (h *Handler) CommentList(w http.ResponseWriter, r *http.Request) {
+	rKey := r.PathValue("rkey")
+	if rKey == "" {
+		http.Error(w, "Invalid document", http.StatusBadRequest)
+		return
+	}
+
+	user := h.currentUser(r)
+	if user == nil {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
+		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+		return
+	}
+
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+		return
+	}
+
+	comments, err := client.ListComments(rKey)
+	if err != nil {
+		log.Printf("CommentList: %v", err)
+		http.Error(w, "Failed to list comments", http.StatusInternalServerError)
+		return
+	}
+
+	h.jsonResponse(w, comments, http.StatusOK)
+}
+
 // --- API: Render markdown ---
 
 func (h *Handler) APIRender(w http.ResponseWriter, r *http.Request) {