Initial MVP: local visual novel library with Ren'Py → PGVN converter

- FastAPI backend: admin bootstrap with forced credential change, admin-created
  users with one-time generated passwords, roles as permission sets
- Games and versions with content-addressed blob storage; forks copy only the
  manifest, so mods share assets with the original
- Worker: archive/RPA extraction, unrpyc for .rpyc, own .rpy parser, Python
  subset translated via ast, media converted to WebP/Opus/WebM
- React panel (library search, game page, upload, users, roles) and a
  framework-free web player with saves, history, skip/auto, transitions
- docker compose: postgres, backend, worker, nginx on a single HTTP port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/auth.tsx

@@ -0,0 +1,53 @@
+import { createContext, useCallback, useContext, useEffect, useState, type ReactNode } from "react";
+import { api, type Me } from "./api";
+
+interface AuthState {
+  me: Me | null;
+  loading: boolean;
+  refresh: () => Promise<void>;
+  setMe: (me: Me | null) => void;
+  logout: () => Promise<void>;
+  can: (perm: string) => boolean;
+}
+
+const AuthContext = createContext<AuthState | null>(null);
+
+export function AuthProvider({ children }: { children: ReactNode }) {
+  const [me, setMe] = useState<Me | null>(null);
+  const [loading, setLoading] = useState(true);
+
+  const refresh = useCallback(async () => {
+    try {
+      setMe(await api.get<Me>("/api/auth/me"));
+    } catch {
+      setMe(null);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+    const onUnauthorized = () => setMe(null);
+    window.addEventListener("pg-unauthorized", onUnauthorized);
+    return () => window.removeEventListener("pg-unauthorized", onUnauthorized);
+  }, [refresh]);
+
+  const logout = async () => {
+    await api.post("/api/auth/logout");
+    setMe(null);
+  };
+  const can = (perm: string) => !!me?.permissions.includes(perm);
+
+  return (
+    <AuthContext.Provider value={{ me, loading, refresh, setMe, logout, can }}>
+      {children}
+    </AuthContext.Provider>
+  );
+}
+
+export function useAuth() {
+  const ctx = useContext(AuthContext);
+  if (!ctx) throw new Error("AuthProvider missing");
+  return ctx;
+}