Implement RFID tag dump PWA with REST API, auth, and CI

Add Next.js app with SQLite/Drizzle storage for sites and LF/HF tag
dumps, multi-user Auth.js (credentials + optional OIDC), personal API
tokens in Settings, versioned /api/v1 for UI and future CLI use,
MCT/Proxmark/JSON import-export, PWA offline shell, Vitest tests, and
GitHub Actions CI.

openapi/openapi.yaml

@@ -0,0 +1,69 @@
+openapi: 3.0.3
+info:
+  title: RFID Database API
+  version: "1.0.0"
+  description: Versioned REST API for RFID tag dump storage. Authenticate with session cookie or Bearer personal access token (rfid_…).
+servers:
+  - url: /api/v1
+paths:
+  /sites:
+    get:
+      summary: List sites
+      security: [{ bearerAuth: [] }]
+    post:
+      summary: Create site
+      security: [{ bearerAuth: [] }]
+  /sites/{id}:
+    get:
+      summary: Get site
+    patch:
+      summary: Update site
+    delete:
+      summary: Delete site
+  /tags:
+    get:
+      summary: List tags
+    post:
+      summary: Create tag
+  /tags/{id}:
+    get:
+      summary: Get tag
+    patch:
+      summary: Update tag
+    delete:
+      summary: Delete tag
+  /tags/by-uid/{uid}:
+    put:
+      summary: Upsert tag by UID within a site
+  /tags/{id}/export:
+    get:
+      summary: Export tag dump (json|proxmark|mct|hex)
+  /tags/import:
+    post:
+      summary: Import dump content into a new tag
+  /search:
+    get:
+      summary: Search sites and tags
+  /backup:
+    get:
+      summary: Export full backup JSON
+    post:
+      summary: Import backup (merge or replace)
+  /tokens:
+    get:
+      summary: List current user API tokens
+    post:
+      summary: Create API token (plaintext returned once)
+  /tokens/{id}:
+    delete:
+      summary: Revoke API token
+  /me:
+    get:
+      summary: Current user profile
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+security:
+  - bearerAuth: []