feat(server): REST API, auth, sources, changes, export

createApp() serves /api/v1 from a typed route table (zod bodies and queries), with
session-cookie and Bearer app-token auth, a CSRF header for cookie writes, login/register
rate limiting, body caps, JSON error mapping, OpenAPI generation and a 404 /ingest mount.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/server/src/routes/meta.ts

@@ -0,0 +1,40 @@
+import { route, type RouteDef } from "../http.ts";
+import { buildOpenApi } from "../openapi.ts";
+
+/** Routes that describe the API and instance. `table` returns the full route table (for OpenAPI). */
+export function metaRoutes(table: () => RouteDef[]): RouteDef[] {
+  let doc: unknown;
+  return [
+    route({
+      method: "GET",
+      path: "openapi.json",
+      summary: "This API's OpenAPI document.",
+      auth: "none",
+      handler: async () => (doc ??= buildOpenApi(table())),
+    }),
+    route({
+      method: "GET",
+      path: "about",
+      summary: "Instance information and data-source attributions.",
+      auth: "none",
+      handler: async ({ deps }) => ({
+        name: "STTracker",
+        attributions: deps.registry
+          .list()
+          .filter((m) => m.attribution)
+          .map((m) => ({ pluginId: m.id, name: m.name, attribution: m.attribution })),
+      }),
+    }),
+    route({
+      method: "POST",
+      path: "admin/plugins/reload",
+      summary: "Rescan the plugin directories (admin).",
+      auth: "session",
+      admin: true,
+      handler: async ({ deps }) => {
+        await deps.registry.reload();
+        return deps.registry.list();
+      },
+    }),
+  ];
+}