Baseline: wave 1A server complete, wave 1B Android scaffold + design system green

assembleDebug, testDebugUnitTest, and recordPaparazziDebug all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016bThmkmyUUdqQpy3MXFFe5

tasks/A-server.txt

@@ -0,0 +1,41 @@
+You are implementing the SERVER half of the Bookshelf project.
+READ FIRST: ~/bookshelf/docs/SPEC.md — it is authoritative. Follow it exactly.
+
+A PocketBase v0.40.2 instance is ALREADY RUNNING at http://127.0.0.1:8090
+(managed by `sprite-env services`; restart with `sprite-env services restart pocketbase`,
+logs at /.sprite/logs/services/pocketbase.log). Superuser credentials are in
+~/bookshelf/server/.dev-credentials. Binary + pb_data are in ~/bookshelf/server/.
+
+Deliver, in ~/bookshelf/server/:
+
+1. setup-schema.sh — idempotent bash (curl+jq only, portable to any Linux box).
+   Takes PB_URL, PB_EMAIL, PB_PASS from env or args. Creates/updates the three
+   collections exactly per SPEC, sets ALL API rules, creates the indexes, and
+   locks down the users collection (createRule=null). Safe to re-run. This is the
+   script the owner will run on their home server, so make its output clear and its
+   errors actionable.
+2. Run it against the live instance and VERIFY, with real curl calls:
+   - anonymous GET of books/shelves/bookcases is REJECTED (expect 4xx) — this is the
+     single most important check in the whole task, do not hand-wave it
+   - anonymous user-registration attempt is REJECTED
+   - an authenticated user CAN do full CRUD on all three collections
+   - relations resolve; file upload to books.cover works (use a small generated PNG)
+   Print the actual status codes you observed. If any check fails, FIX IT and re-verify.
+3. create-user.sh — superuser-driven account creation (the owner and their wife).
+   No self-registration path may exist.
+4. deploy/ — with a README.md that a competent-but-not-expert person can follow:
+   - bookshelf.service (systemd, runs as non-root, Restart=always)
+   - Dockerfile + docker-compose.yml
+   - backup.sh (sqlite-safe backup of pb_data, plus how to restore)
+   - guidance on reaching a home server from outside: Tailscale (recommended)
+     vs port-forward + Caddy/TLS. Be concrete about the tradeoffs. HTTPS is
+     required because the app sends passwords.
+5. Confirm pb_migrations/ captured the schema so a fresh instance self-provisions.
+   Test this: point a throwaway instance at a NEW empty data dir with the same
+   migrations, start it, confirm collections appear, then delete the throwaway.
+6. server/README.md — quickstart.
+
+Do not modify ~/bookshelf/app or ~/bookshelf/docs.
+Keep ~/bookshelf/server/.dev-credentials out of version control (write .gitignore).
+Finish with a <=25 line report: what you built, the verification status codes, and
+anything you had to deviate from in the SPEC and why.