Was curious to see if I ran into any oauth snags but this seems to work
well! Neat.

Made some decisions about how to handle all this. Wanted to keep things
simple but ended up going with sitebase-specific lexicons to make sure
we're using the `site.standard.document.content` union type properly.

This means setting up a sitebase PDS sooner than later so these can be
defined and published there. Going to do it right!

TODO for textContent in the future

Also formatting

Co-authored-by: Shelley <shelley@exe.dev>

- Add file-based logger (data/app.log) with JSON metadata support
- Add database cleanup script (hourly via cron)
- Removes OAuth states older than 1 hour
- Removes sessions older than 30 days
- Vacuums SQLite database
- Configure logrotate for app.log and cleanup.log
- Daily rotation, 14 days retention
- Compression enabled

Co-authored-by: Shelley <shelley@exe.dev>

Security fixes based on adversarial audit:

1. CSRF Protection (CRITICAL)
- Added CSRF middleware with double-submit cookie pattern
- All POST forms now include hidden _csrf field
- Tokens validated on all state-changing requests

2. Private Key Permissions (HIGH)
- Private key now written with mode 0600 (owner read/write only)
- Prevents other system users from reading the key

3. Input Validation (MEDIUM)
- Added TID format validation for rkey parameters
- Prevents potential path traversal or injection via malformed IDs

4. Added validation library for future use
- TID validation
- HTTPS URL validation
- String sanitization helper

Co-authored-by: Shelley <shelley@exe.dev>

The client-metadata.json and jwks.json endpoints must be publicly
accessible by Bluesky's OAuth server. Added:
- Access-Control-Allow-Origin: * header
- Cache-Control header for reasonable caching

Note: The exe.dev proxy must be set to public for OAuth to work:
ssh exe.dev share set-public stdeditor
Co-authored-by: Shelley <shelley@exe.dev>

- Use SQLite for session and state persistence (survives restarts)
- Use ES256 private key for confidential client authentication
- Expose /client-metadata.json and /jwks.json at root level
- Configure for standard HTTPS URL (no custom ports - required by Bluesky)
- Add proper error handling and error messages on login page
- Update documentation with deployment instructions

Co-authored-by: Shelley <shelley@exe.dev>