Game API Worker served on the api subdomain. A Hono app serving the game's API surface. Database-backed queries and on-disk JSON files are stubbed for now — no real bindings yet.

Behavior

Auth-gated routes validate the Bearer JWT issued by the auth worker (same dev secret, see src/jwt.ts) and 401 when it's missing/invalid.
Static data is served verbatim:
- src/default-avatar-items.ts → GET /api/avatar/v4/items
- src/default-settings.ts → GET /api/settings/v2
DB-backed reads return empty collections / not-found.
File-backed reads return empty placeholders, each marked TODO: hydrate in src/api.app.ts (Workers have no filesystem — these will move to a binding or inline JSON later).

TODO before production

Wire a DB binding (D1/DO) for rooms, avatars, settings, gifts, balances, etc.
Hydrate the TODO: hydrate endpoints with real config/JSON.
Move the JWT secret to a shared secret binding (shared with auth).
Persist uploads from POST /api/images/v4/uploadsaved (e.g. R2).