Initial MVP: local visual novel library with Ren'Py → PGVN converter

- FastAPI backend: admin bootstrap with forced credential change, admin-created
  users with one-time generated passwords, roles as permission sets
- Games and versions with content-addressed blob storage; forks copy only the
  manifest, so mods share assets with the original
- Worker: archive/RPA extraction, unrpyc for .rpyc, own .rpy parser, Python
  subset translated via ast, media converted to WebP/Opus/WebM
- React panel (library search, game page, upload, users, roles) and a
  framework-free web player with saves, history, skip/auto, transitions
- docker compose: postgres, backend, worker, nginx on a single HTTP port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/main.py

@@ -0,0 +1,41 @@
+import logging
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI, HTTPException
+from fastapi.responses import FileResponse
+
+from app.blobs import BLOB_ID_RE, blob_path
+from app.bootstrap import bootstrap
+from app.config import get_settings
+from app.db import SessionLocal
+from app.routers import auth, games, roles, users, versions
+
+logging.basicConfig(level=logging.INFO)
+
+
+@asynccontextmanager
+async def lifespan(_: FastAPI):
+    if get_settings().secret_key == "change-me":
+        logging.getLogger(__name__).warning("SECRET_KEY is the default value — set it in .env")
+    async with SessionLocal() as db:
+        await bootstrap(db)
+    yield
+
+
+app = FastAPI(title="pgames-manager", lifespan=lifespan, docs_url="/api/docs",
+              openapi_url="/api/openapi.json")
+for r in (auth, users, roles, games, versions):
+    app.include_router(r.router)
+
+
+@app.get("/api/health")
+async def health() -> dict[str, str]:
+    return {"status": "ok"}
+
+
+@app.get("/blobs/{blob_id}")
+async def blob(blob_id: str) -> FileResponse:
+    """Fallback for running without nginx; in compose nginx serves /blobs itself."""
+    if not BLOB_ID_RE.match(blob_id) or not (path := blob_path(blob_id)).is_file():
+        raise HTTPException(404)
+    return FileResponse(path, headers={"Cache-Control": "public, max-age=31536000, immutable"})