Baseline: wave 1A server complete, wave 1B Android scaffold + design system green

assembleDebug, testDebugUnitTest, and recordPaparazziDebug all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bThmkmyUUdqQpy3MXFFe5

server/deploy/bookshelf.service

@@ -0,0 +1,36 @@
+[Unit]
+Description=Bookshelf PocketBase server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+# Adjust to your setup: a dedicated, unprivileged system account.
+# Create it once with:  sudo useradd --system --home /opt/bookshelf --shell /usr/sbin/nologin bookshelf
+User=bookshelf
+Group=bookshelf
+
+# All paths below assume the whole ~/bookshelf/server tree (pocketbase binary,
+# pb_data/, pb_migrations/, pb_hooks/) is deployed to /opt/bookshelf.
+# Adjust WorkingDirectory/ExecStart if you deploy elsewhere.
+WorkingDirectory=/opt/bookshelf
+ExecStart=/opt/bookshelf/pocketbase serve \
+  --http=127.0.0.1:8090 \
+  --dir=/opt/bookshelf/pb_data \
+  --migrationsDir=/opt/bookshelf/pb_migrations \
+  --hooksDir=/opt/bookshelf/pb_hooks
+
+Restart=always
+RestartSec=5
+
+# Hardening (safe defaults for a single-purpose service; loosen only if
+# something concrete breaks).
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/bookshelf/pb_data
+CapabilityBoundingSet=
+AmbientCapabilities=
+
+[Install]
+WantedBy=multi-user.target