- Add setup-zitadel.sh: idempotent script that creates PVM project
and OIDC app via Zitadel Management API using machine user PAT
- Add machine user + PAT auto-generation to docker-compose via
FIRSTINSTANCE env vars with bind-mounted machinekey directory
- Add SMTP configuration for email sending (verification, password reset)
- Fix JWT algorithm confusion attack: restrict to RS256/384/512 only
- Add docs/TODO_SECURITY.md tracking review findings
- Update .env.example files with correct local dev URLs
- Add docker/machinekey/ to .gitignore
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Comprehensive evaluation of 11 auth frameworks for PVM's
split-brain architecture. Recommends self-hosted Zitadel v3
for its Rust crate, OIDC JWKS for offline JWT validation on
RPi5 nodes, and zero-cost self-hosting on existing Hetzner PVE.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Resolve all open questions from tech stack review:
- Self-hosted on Hetzner PVE (LXC + Docker)
- Event-based sync via NATS JetStream
- Generic display system with Android client (no Cast SDK dep)
- Docker-based RPi5 provisioning
- No money handling, 72h offline limit, REST + OpenAPI
- PVM signup-first for player accounts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1,190-line research covering all 18 technology areas for PVM:
Rust/Axum backend, SvelteKit frontend, Postgres + libSQL databases,
NATS + JetStream messaging, DragonflyDB caching, and more.
Includes recommended stack summary and open questions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Establish PVM (Poker Venue Manager) project with product vision
document covering all feature domains and a clean README with
project overview.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
