feat: comedy overhaul start, profile page, bot setup docs, auth improvements

Rewrites announcer commentary (HYPE_LINES, DEEP_INTROS, ROUND_HYPE) with
modern edgy humor. Adds BOT_SETUP.md, bot SDK, customization engine,
profile page character display, persistent auth, rate limit tweaks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -4,6 +4,7 @@ import { createHash, randomBytes } from 'crypto'
 import { db, schema } from '../db/index.js'
 import { eq, sql } from 'drizzle-orm'
 import { isAllowedWebhookUrl } from '../engine/orchestrator.js'
+import { validateCustomization } from '../engine/customization.js'
 import { testWebhook } from '../engine/webhook-test.js'
 import { rateLimit } from '../middleware/rate-limit.js'
 
@@ -31,19 +32,27 @@ authRouter.post('/login', async (c) => {
     bestStreak: schema.bots.bestStreak,
     tier: schema.bots.tier,
     isActive: schema.bots.isActive,
+    customization: schema.bots.customization,
   }).from(schema.bots).where(eq(schema.bots.publicKey, pubkey)).limit(1)
 
   if (rows.length === 0) {
     return c.json({ exists: false, pubkey })
   }
 
-  return c.json({ exists: true, bot: rows[0] })
+  const bot = rows[0]
+  return c.json({
+    exists: true,
+    bot: {
+      ...bot,
+      customization: bot.customization ? JSON.parse(bot.customization) : null,
+    },
+  })
 })
 
 // Register a new bot with Nostr pubkey
 authRouter.post('/register', rateLimit(3600_000, 5), async (c) => {
   const body = await c.req.json()
-  const { pubkey, name, webhookUrl, archetype, profilePicUrl } = body
+  const { pubkey, name, webhookUrl, archetype, profilePicUrl, customization: rawCustomization } = body
 
   if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
     return c.json({ error: 'Invalid pubkey.' }, 400)
@@ -57,6 +66,12 @@ authRouter.post('/register', rateLimit(3600_000, 5), async (c) => {
     return c.json({ error: 'Name must be alphanumeric, hyphens, or underscores.' }, 400)
   }
 
+  // Validate customization
+  const custResult = validateCustomization(rawCustomization)
+  if (!custResult.valid) {
+    return c.json({ error: custResult.error }, 400)
+  }
+
   const normalizedName = name.toLowerCase()
 
   if (!webhookUrl || typeof webhookUrl !== 'string') {
@@ -106,37 +121,42 @@ authRouter.post('/register', rateLimit(3600_000, 5), async (c) => {
   const id = nanoid(12)
   const secret = randomBytes(32).toString('hex')
 
+  const effectiveArchetype = custResult.data.archetype || archetype || 'standard'
+  const custJson = Object.keys(custResult.data).length > 0 ? JSON.stringify(custResult.data) : null
+
   await db.insert(schema.bots).values({
     id,
     name: normalizedName,
     webhookUrl,
     avatarSeed: normalizedName,
-    archetype: archetype || 'standard',
+    archetype: effectiveArchetype,
     secretHash: createHash('sha256').update(secret).digest('hex'),
     publicKey: pubkey,
     profilePicUrl: profilePicUrl || null,
+    customization: custJson,
     createdAt: new Date().toISOString(),
   })
 
   return c.json({
     id,
     name: normalizedName,
-    archetype: archetype || 'standard',
+    archetype: effectiveArchetype,
+    customization: custResult.data,
     webhookLatencyMs: testResult.latencyMs,
     message: 'Bot registered. Webhook verified.',
   }, 201)
 })
 
-// Update bot webhook (requires pubkey match)
+// Update bot webhook and/or customization (requires pubkey match)
 authRouter.post('/update', async (c) => {
   const body = await c.req.json()
-  const { pubkey, webhookUrl, profilePicUrl } = body
+  const { pubkey, webhookUrl, profilePicUrl, customization: rawCustomization } = body
 
   if (!pubkey || typeof pubkey !== 'string') {
     return c.json({ error: 'Invalid pubkey.' }, 400)
   }
 
-  const rows = await db.select({ id: schema.bots.id })
+  const rows = await db.select({ id: schema.bots.id, customization: schema.bots.customization })
     .from(schema.bots)
     .where(eq(schema.bots.publicKey, pubkey))
     .limit(1)
@@ -151,7 +171,6 @@ authRouter.post('/update', async (c) => {
     if (!isAllowedWebhookUrl(webhookUrl)) {
       return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
     }
-    // Test new webhook before accepting
     const testResult = await testWebhook(webhookUrl)
     if (!testResult.reachable || !testResult.validResponse) {
       return c.json({
@@ -166,6 +185,21 @@ authRouter.post('/update', async (c) => {
 
   if (profilePicUrl) updates.profilePicUrl = profilePicUrl
 
+  if (rawCustomization !== undefined) {
+    const custResult = validateCustomization(rawCustomization)
+    if (!custResult.valid) {
+      return c.json({ error: custResult.error }, 400)
+    }
+    // Merge with existing customization
+    const existing = rows[0].customization ? JSON.parse(rows[0].customization) : {}
+    const merged = { ...existing, ...custResult.data }
+    updates.customization = JSON.stringify(merged)
+    // Update archetype if set in customization
+    if (custResult.data.archetype) {
+      updates.archetype = custResult.data.archetype
+    }
+  }
+
   if (Object.keys(updates).length > 0) {
     await db.update(schema.bots).set(updates).where(eq(schema.bots.id, rows[0].id))
   }