feat: Phases 4-7 — Full Feature Expansion (26 features)

Phase 4 — New Widget Types:
- Clock/Weather, System Stats, RSS/Feed, Calendar, Markdown,
  Metric/Counter, Link Group, Camera/Stream widgets
- Backend services with caching for each data source
- Full creation form with dynamic config fields per type

Phase 5 — Visual & Styling Enhancements:
- Glassmorphism card style (solid/glass/outline)
- Board-level themes with per-board hue/saturation
- Animated SVG status rings replacing static dots
- Card size options (compact/medium/large)
- Custom CSS injection (admin + per-board, sanitized)
- Wallpaper backgrounds with blur/overlay/parallax

Phase 6 — Functional Features:
- Favorites bar with drag-and-drop reordering
- Recent apps tracking with privacy toggle
- Uptime dashboard page (/status, guest-accessible)
- Notifications system (Discord/Slack/Telegram/HTTP webhooks)
- App tags with filtering in board view
- Multi-URL app cards with expandable sub-links
- Personal API tokens with scoped permissions
- Audit log with retention and admin viewer

Phase 7 — Quality of Life:
- Onboarding wizard (5-step first-launch setup)
- App URL health preview with favicon/title detection
- Board templates (4 built-in + custom import/export)
- Keyboard shortcut overlay (j/k nav, 1-9 boards, ? help)

212 files changed, 15641 insertions, 980 deletions.
Build, lint, type check, and 222 tests all pass.

src/hooks.server.ts

@@ -3,6 +3,8 @@ import { redirect } from '@sveltejs/kit';
 import { verifyAccessToken } from '$lib/server/services/authService.js';
 import * as authService from '$lib/server/services/authService.js';
 import * as userService from '$lib/server/services/userService.js';
+import * as apiTokenService from '$lib/server/services/apiTokenService.js';
+import { extractBearerToken } from '$lib/server/middleware/authenticate.js';
 import { isBoardGuestAccessible } from '$lib/server/middleware/guestAccess.js';
 
 const PUBLIC_PATHS = ['/login', '/register', '/auth/', '/api/health'];
@@ -91,6 +93,31 @@ export const handle: Handle = async ({ event, resolve }) => {
 		}
 	}
 
+	// If still no valid session, try API token from Authorization header
+	if (!event.locals.user) {
+		const bearerToken = extractBearerToken(event);
+		if (bearerToken) {
+			try {
+				const tokenResult = await apiTokenService.validateToken(bearerToken);
+				if (tokenResult) {
+					const user = await userService.findById(tokenResult.userId);
+					event.locals.user = {
+						id: user.id,
+						email: user.email,
+						displayName: user.displayName,
+						role: user.role as 'admin' | 'user'
+					};
+					event.locals.session = {
+						id: user.id,
+						expiresAt: new Date(Date.now() + 15 * 60 * 1000)
+					};
+				}
+			} catch {
+				// API token validation failed — continue as unauthenticated
+			}
+		}
+	}
+
 	// Route protection
 	const { pathname } = event.url;