docs: add mobile apps plan (React Native + Expo)

Fix critical issues:
- Fix OAuth architecture: remove appview mediation endpoints, rewrite auth
flow to have mobile app exchange tokens directly with user's PDS and
present DPoP-bound tokens to appview (preserves AT Proto decentralization)
- Update iOS PWA claim: reflect iOS 16.4+ Web Push support with accurate
constraints (requires add-to-home-screen, constrained UX)
- Add missing reactions endpoints to API inventory with note about DB/lexicon
gaps
- Remove premature API versioning: defer /api/v1/* until post-v1 to avoid
breaking changes while API still evolving

Improvements per review suggestions:
- Elevate DPoP key management to dedicated Authentication subsection with
mobile-specific secure storage details (secure enclave/keystore)
- Clarify devices table is local/appview-managed, not AT Proto record
- Clarify mobile build pipeline: Metro bundler (expo/eas build) vs Turborepo
(lexicon types used at dev/typecheck only)
- Reframe component sharing question: web and mobile paradigms fundamentally
different, share types/contracts not UI components

docs: add comprehensive phpBB research and gap analysis

Critical fixes:
- Add note confirming Jetstream wildcard syntax is supported

Important fixes:
- Correct post grapheme limit (300, not 3000 chars)
- Acknowledge that limit may need revisiting for forum posts
- Fix categoryId schema mismatch (posts use forumUri)
- Update event routing to use forumUri with implementation note
- Fix Hono JSX rendering API (use JSX directly in streamSSE, not renderToString)
- Clarify "zero custom client-side JS" (HTMX itself is ~14KB)
- Update AT Proto record description (supports updates via putRecord)
- Fix empty <tr> sentinel by moving SSE attributes to <tbody>

All changes address feedback from PR review to ensure technical
accuracy before merge.

Add theming system design plan

Fix lexicon convention issues identified in code review:
- Use knownValues (not implicit enum) for colorScheme field
- Wrap theme references with strongRef for CID integrity checks
- Separate themePolicy into its own singleton to prevent forum record bloat
- Note that forum.theme must be added to CLAUDE.md ownership list

Add missing implementation details:
- Elevate CSS sanitization from open question to mandatory Phase 3 gate
- Document cache key must include resolved color scheme
- Constrain fontUrls to HTTPS with allowlist consideration
- Add database schema notes for themes and memberships tables
- Clarify AppView endpoints are REST, not XRPC

Updates theme resolution waterfall to show CID integrity checks via strongRef.

Outlines strategy for iOS/Android apps consuming the existing appview
JSON API. Covers technology choice (React Native + Expo), AT Proto OAuth
on mobile, push notifications architecture, offline support, and a
4-phase implementation roadmap. Also adds mobile apps section to the
main project plan's future roadmap.

https://claude.ai/code/session_013mSCQhwArU9acUKZYweD8L

Detailed architectural research on connecting the AT Proto Jetstream
firehose to the browser via Server-Sent Events and HTMX's declarative
SSE extension. Covers all three layers:

1. Jetstream consumer (@skyware/jetstream with space.atbb.* filter)
2. In-process EventEmitter → Hono SSE streaming endpoints
3. HTMX sse-swap attributes for zero-JS live DOM updates

Includes concrete code sketches, scaling considerations (EventEmitter
→ Redis Pub/Sub → PostgreSQL LISTEN/NOTIFY), implementation roadmap,
and comparison showing why this is atBB's strongest architectural
differentiator over phpBB/Discourse/Flarum/NodeBB.

https://claude.ai/code/session_012nLGUeocmDKttJz1VYFPPA

Replace the single active-theme model with a full theme policy system:
- Admin curates available themes with separate light/dark defaults
- Users can pick their own theme from the available list
- Theme resolution waterfall: user pref → color scheme → forum default → fallback
- New themePolicy on forum.forum, preferredTheme on membership
- AppView API endpoints for theme CRUD and user preference
- Updated presets to ship light+dark variants
- 5-phase implementation plan reflecting new scope

https://claude.ai/code/session_01Y3xoFe9ty2gduA4KHVKeYx

Deep research into phpBB's feature set, common complaints, decline
reasons, and lessons from modern competitors (Discourse, Flarum,
XenForo). Includes prioritized gap analysis comparing atBB's current
feature set against phpBB's, with actionable recommendations.

Key findings:
- AT Proto identity is atBB's biggest advantage (spam resistance,
portable identity, data ownership)
- Critical missing features: rich text/markdown, unread tracking,
notifications, search, post reporting
- phpBB's permission complexity is a cautionary tale — keep it simple
- Discourse's trust levels are worth adopting in simplified form
- Real-time updates via firehose + HTMX SSE would be a differentiator

https://claude.ai/code/session_012nLGUeocmDKttJz1VYFPPA

Plan for a phpBB-inspired admin-customizable theme system with a
neobrutal default. Covers CSS custom property architecture, design
token schema, lexicon for theme storage on Forum DID, admin editor
workflow, and built-in preset themes. Scoped as post-MVP work.

https://claude.ai/code/session_01Y3xoFe9ty2gduA4KHVKeYx

Two options for running Postgres locally:

1. Docker Compose: `docker compose up -d` starts a PostgreSQL 17
container on port 5432 with persistent volume storage.

2. Devenv: `devenv up` now also starts a managed PostgreSQL 17 service
alongside the appview and web dev servers.

Both use the same credentials (atbb/atbb) and database name (atbb),
matching the existing DATABASE_URL in .env.example.

https://claude.ai/code/session_01T1qT4qo8eoui9X7f32PVt4

Use Node 22+ native --env-file=../../.env in dev/spike scripts so
packages pick up root .env variables without a dotenv dependency.
Also add devenv, direnv, and pre-commit entries to .gitignore.

Documents architecture, dev setup, lexicon conventions, AT Protocol
patterns, TypeScript/Hono gotchas, and git conventions.

Mark lexicon definitions and project scaffolding as complete, with
result notes. Spike script is written but awaiting PDS credentials.

Set up Turborepo monorepo with pnpm workspaces and devenv for the atBB
decentralized forum project. Defines 5 new AT Proto lexicon schemas
(category, role, membership, reaction, modAction) alongside the 3
existing ones, with a YAML→JSON→TypeScript build pipeline. Scaffolds
the Hono AppView API server, HTMX web UI server, and PDS spike script.