feat: add comment handlers

cmd/server/main.go

···
 	mux.HandleFunc("POST /api/docs/{rkey}/save", h.APIDocumentSave)
 	mux.HandleFunc("PUT /api/docs/{rkey}/autosave", h.APIDocumentAutoSave)
 	mux.HandleFunc("DELETE /api/docs/{rkey}", h.APIDocumentDelete)
+	mux.HandleFunc("POST /api/docs/{rkey}/comments", h.CommentCreate)
+	mux.HandleFunc("GET /api/docs/{rkey}/comments", h.CommentList)
 
 	// Middleware stack
 	stack := middleware.Logger(

internal/atproto/xrpc/client.go

···
 	"github.com/limeleaf/diffdown/internal/model"
 )
 
+const collectionComment = "com.diffdown.comment"
+
 type Client struct {
 	db      *db.DB
 	userID  string
···
 	}
 	return nil
 }
+
+// CreateComment creates a new comment record.
+func (c *Client) CreateComment(comment *model.Comment) (string, error) {
+	now := time.Now().UTC().Format(time.RFC3339)
+	record := map[string]interface{}{
+		"$type":       "com.diffdown.comment",
+		"documentUri": comment.DocumentURI,
+		"paragraphId": comment.ParagraphID,
+		"text":        comment.Text,
+		"authorDid":   comment.AuthorDID,
+		"createdAt":   now,
+	}
+
+	uri, _, err := c.CreateRecord(collectionComment, record)
+	if err != nil {
+		return "", err
+	}
+	return uri, nil
+}
+
+// ListComments lists all comments for a document.
+func (c *Client) ListComments(rkey string) ([]model.Comment, error) {
+	records, _, err := c.ListRecords(c.session.DID, collectionComment, 100, "")
+	if err != nil {
+		return nil, err
+	}
+
+	var comments []model.Comment
+	for _, rec := range records {
+		var comment model.Comment
+		if err := json.Unmarshal(rec.Value, &comment); err != nil {
+			continue
+		}
+		comment.URI = rec.URI
+		comments = append(comments, comment)
+	}
+	return comments, nil
+}

internal/handler/handler.go

···
 )
 
 const collectionDocument = "com.diffdown.document"
+const collectionComment = "com.diffdown.comment"
 
 type Handler struct {
 	DB    *db.DB
···
 	}
 
 	h.jsonResponse(w, map[string]string{"status": "ok"})
+}
+
+// --- API: Comments ---
+
+func (h *Handler) CommentCreate(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	rKey := r.PathValue("rkey")
+	if rKey == "" {
+		http.Error(w, "Invalid document", http.StatusBadRequest)
+		return
+	}
+
+	var req struct {
+		ParagraphID string `json:"paragraphId"`
+		Text        string `json:"text"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request", http.StatusBadRequest)
+		return
+	}
+
+	if req.Text == "" {
+		http.Error(w, "Comment text required", http.StatusBadRequest)
+		return
+	}
+
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		log.Printf("CommentCreate: xrpc client: %v", err)
+		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+		return
+	}
+
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
+		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+		return
+	}
+
+	comment := &model.Comment{
+		DocumentURI: fmt.Sprintf("at://%s/com.diffdown.document/%s", session.DID, rKey),
+		ParagraphID: req.ParagraphID,
+		Text:        req.Text,
+		AuthorDID:   session.DID,
+	}
+
+	uri, err := client.CreateComment(comment)
+	if err != nil {
+		log.Printf("CommentCreate: %v", err)
+		http.Error(w, "Failed to create comment", http.StatusInternalServerError)
+		return
+	}
+
+	w.WriteHeader(http.StatusCreated)
+	h.jsonResponse(w, map[string]string{"uri": uri})
+}
+
+func (h *Handler) CommentList(w http.ResponseWriter, r *http.Request) {
+	rKey := r.PathValue("rkey")
+	if rKey == "" {
+		http.Error(w, "Invalid document", http.StatusBadRequest)
+		return
+	}
+
+	user := h.currentUser(r)
+	if user == nil {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		log.Printf("CommentList: xrpc client: %v", err)
+		http.Error(w, "Not authenticated with ATProto", http.StatusUnauthorized)
+		return
+	}
+
+	comments, err := client.ListComments(rKey)
+	if err != nil {
+		log.Printf("CommentList: %v", err)
+		http.Error(w, "Failed to list comments", http.StatusInternalServerError)
+		return
+	}
+
+	w.WriteHeader(http.StatusOK)
+	h.jsonResponse(w, comments)
 }
 
 // --- API: Render markdown ---

internal/model/models.go

···
 	RawMarkdown string `json:"rawMarkdown"`
 }
 
+type Comment struct {
+	URI         string `json:"uri,omitempty"`
+	DocumentURI string `json:"documentUri"`
+	ParagraphID string `json:"paragraphId"`
+	Text        string `json:"text"`
+	AuthorDID   string `json:"authorDid"`
+	CreatedAt   string `json:"createdAt,omitempty"`
+}
+
 // RKeyFromURI extracts the rkey (last path segment) from an at:// URI.
 func RKeyFromURI(uri string) string {
 	parts := strings.Split(uri, "/")
···
 	}
 	return ""
 }
-