Baseline: wave 1A server complete, wave 1B Android scaffold + design system green

assembleDebug, testDebugUnitTest, and recordPaparazziDebug all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bThmkmyUUdqQpy3MXFFe5

server/pb_hooks/main.pb.js

@@ -0,0 +1,21 @@
+/// <reference path="../pb_data/types.d.ts" />
+
+// PocketBase's declarative API rules act as row-level filters for the
+// "list"/"search" action: an unsatisfiable listRule (e.g. requiring auth)
+// still returns 200 with an empty result set rather than an error, because
+// the rule is just a SQL WHERE clause under the hood. See
+// https://github.com/pocketbase/pocketbase/discussions/6492
+//
+// Bookshelf is a private, two-person library — no anonymous caller should
+// ever get a 200 back from these endpoints, even an empty one, since some
+// HTTP/JS clients treat "200 with []" as a successful, allowed request.
+// This hook makes that explicit: anonymous list/search requests against the
+// three app collections are rejected with 403, matching create/update/
+// view/delete (which already 400/404 for unauthenticated callers via the
+// declarative rules alone).
+onRecordsListRequest((e) => {
+  if (!e.auth) {
+    throw new ForbiddenError("Authentication required.");
+  }
+  e.next();
+}, "bookcases", "shelves", "books");