Minecraft 26.2 Fabric server stack with CraftDeck management panel

- docker-compose: itzg/minecraft-server (Fabric, offline mode, whitelist
  enforced, Modrinth-managed mods), itzg/mc-backup sidecar, custom dashboard
- Gated auth for offline mode: approve username -> whitelisted with a short
  registration window -> EasyAuth /register + /login; auto-revoke on expiry
- CraftDeck panel (Next.js 16, zero native deps): live console (SSE), players
  & stats, lag diagnostics (server TPS vs player ping via spark), performance
  graphs, Modrinth mod search/manager, backups & restore, sandboxed file
  browser/editor, .env config editor with compose apply, cron schedules,
  Discord alerts, scrypt-hashed panel login
- scripts/setup.sh generates secrets; docs/ covers auth, mods, updating,
  backups, networking (Tailscale), troubleshooting

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dashboard/src/app/api/files/download/route.ts

@@ -0,0 +1,23 @@
+import { NextRequest } from "next/server";
+import { Readable } from "node:stream";
+import { fileStream } from "@/server/files";
+import { fail } from "@/server/api";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: NextRequest) {
+  const p = req.nextUrl.searchParams.get("path");
+  if (!p) return fail("Missing path");
+  try {
+    const { stream, size, name } = fileStream(p);
+    return new Response(Readable.toWeb(stream) as ReadableStream, {
+      headers: {
+        "Content-Type": "application/octet-stream",
+        "Content-Length": String(size),
+        "Content-Disposition": `attachment; filename="${name.replace(/"/g, "")}"`,
+      },
+    });
+  } catch (err) {
+    return fail((err as Error).message, 404);
+  }
+}

dashboard/src/app/api/files/route.ts

@@ -0,0 +1,39 @@
+import { NextRequest } from "next/server";
+import { listDir, readTextFile, writeTextFile, deletePath, makeDir } from "@/server/files";
+import { ok, fail, readJson, handle } from "@/server/api";
+
+export const dynamic = "force-dynamic";
+
+export async function GET(req: NextRequest) {
+  return handle(async () => {
+    const dir = req.nextUrl.searchParams.get("dir");
+    const file = req.nextUrl.searchParams.get("file");
+    if (file !== null) return ok(readTextFile(file));
+    return ok(listDir(dir ?? ""));
+  });
+}
+
+type Body =
+  | { op: "write"; path: string; content: string }
+  | { op: "mkdir"; path: string }
+  | { op: "delete"; path: string };
+
+export async function POST(req: NextRequest) {
+  return handle(async () => {
+    const body = await readJson<Body>(req);
+    if (!body.path && body.path !== "") return fail("Missing path");
+    switch (body.op) {
+      case "write":
+        writeTextFile(body.path, body.content ?? "");
+        return ok({ written: body.path });
+      case "mkdir":
+        makeDir(body.path);
+        return ok({ created: body.path });
+      case "delete":
+        deletePath(body.path);
+        return ok({ deleted: body.path });
+      default:
+        return fail("Unknown operation");
+    }
+  });
+}

dashboard/src/app/api/files/upload/route.ts

@@ -0,0 +1,21 @@
+import { NextRequest } from "next/server";
+import path from "node:path";
+import { writeBinaryFile } from "@/server/files";
+import { ok, fail, handle } from "@/server/api";
+
+const MAX_UPLOAD = 256 * 1024 * 1024; // mod jars and datapacks, not world dumps
+
+export async function POST(req: NextRequest) {
+  return handle(async () => {
+    const form = await req.formData();
+    const dir = (form.get("dir") as string) ?? "";
+    const file = form.get("file");
+    if (!(file instanceof File)) return fail("Missing file");
+    if (file.size > MAX_UPLOAD) return fail("File too large (256 MB max)");
+    const name = path.basename(file.name);
+    if (!name || name.startsWith(".")) return fail("Invalid file name");
+    const buf = Buffer.from(await file.arrayBuffer());
+    writeBinaryFile(path.join(dir, name), buf);
+    return ok({ uploaded: name, size: file.size });
+  });
+}