refactor: migrate main.py to modular routers and add project roadmap

- Migrated monolithic main.py to feature-scoped routers in app/routers/
- Added GEMINI.md for project context and AI instructional guidelines
- Updated README.md with a comprehensive modernization plan (SQL migration, robust scraping DSL, frontend modernization)
- Improved authentication with cookie support and modular JS
- Updated test suite and documentation

app/config.py

@@ -1,7 +1,11 @@
 """Application configuration using environment variables"""
+import secrets
+
+
 from pydantic_settings import BaseSettings
+from pydantic import model_validator
 from typing import List
-import os
+
 
 class Settings(BaseSettings):
     """Application settings loaded from environment variables"""
@@ -16,6 +20,38 @@ class Settings(BaseSettings):
     port: int = 3000
     reload: bool = True
 
+    # Authentication
+    jwt_secret_key: str = "dev-secret-change-in-production"
+    jwt_algorithm: str = "HS256"
+    access_token_expire_minutes: int = 60 * 24  # 24 hours (short-lived for security)
+    refresh_token_expire_days: int = 30
+
+    @model_validator(mode="after")
+    def validate_jwt_secret_key(self) -> "Settings":
+        """Validate JWT_SECRET_KEY is not the default or too short"""
+        default_secret = "dev-secret-change-in-production"
+
+        if self.jwt_secret_key == default_secret:
+            raise ValueError(
+                f"JWT_SECRET_KEY cannot be the default value '{default_secret}'. "
+                f"Please set a secure secret in your .env file. "
+                f"Use Settings.generate_secret() to generate a secure secret."
+            )
+
+        if len(self.jwt_secret_key) < 32:
+            raise ValueError(
+                f"JWT_SECRET_KEY must be at least 32 characters long. "
+                f"Current length: {len(self.jwt_secret_key)} characters. "
+                f"Use Settings.generate_secret() to generate a secure secret."
+            )
+
+        return self
+
+    @staticmethod
+    def generate_secret() -> str:
+        """Generate a cryptographically secure JWT secret key"""
+        return secrets.token_urlsafe(32)
+
     # Downloads
     download_dir: str = "downloads"
     max_parallel_downloads: int = 3
@@ -26,7 +62,7 @@ class Settings(BaseSettings):
         "http://localhost:3000",
         "http://127.0.0.1:3000",
         "http://192.168.1.204:3000",
-        "http://192.168.1.204"
+        "http://192.168.1.204",
     ]
 
     # Storage