docs: restructure server and web documentation into ADR files and a

routing table

docs/server/roadmap.md

@@ -1,40 +1,28 @@
-# Roadmap
+# Server Roadmap
 
-## v0
+## Available Capabilities
 
-| Feature | Status | Notes |
-|---------|--------|-------|
-| CLI config management | ✅ | Viper YAML + env + flags, typed Duration config |
-| JWT authentication | ✅ | access + refresh tokens, atomic single-use refresh sessions, app passkey support |
-| Web API foundation | ✅ | WebApp composition, Gin router, graceful shutdown, `GET /api/v1/version` |
-| File upload/download/manage APIs | 🛠 WIP | REST API via Gin |
-| Admin endpoints | 🛠 WIP | user service boundary in place for superusers |
-| WebDAV | 🛠 WIP | future v0 or v1 |
+- YAML and environment configuration loading
+- SQLite and PostgreSQL metadata persistence
+- JWT access and single-use refresh tokens
+- Account and application-passkey APIs
+- File listing, upload, download, directory creation, metadata update, and soft deletion
+- Ownership concealment for file resources
+- Administrator user listing, lookup, and deletion
+- Local storage with staged upload promotion
+- Request IDs, structured logging, and graceful shutdown
+- Architecture, repository, service, handler, and route integration tests
 
-## Implementation Tasks
+## Planned v0 Work
 
-Package-level implementation order (each task includes unit tests):
+- Add `mygo config` for instance configuration management.
+- Add `mygo status` for server status inspection.
+- Complete the remaining administrator workflows.
+- Define the WebDAV delivery milestone and acceptance criteria.
 
-1. `internal/config` — Viper loader, config struct ✅
-2. `internal/app` — runtime dependency container ✅
-3. `internal/model` — domain types, error codes ✅
-4. `internal/api` — protocol-neutral error kind to REST response mapping ✅
-5. `internal/auth` — JWT utils ✅
-6. `internal/storage` — backend interface + local fs with staged upload promotion
-7. `internal/repository` — command-scoped mutation capabilities + GORM/SQLite transaction protocol ✅
-8. `internal/service` — auth, file, admin services ✅
-9. `internal/middleware` — logger, cors, auth ✅ (auth done; principal boundary enforced)
-10. `internal/handler` — auth, account, file, admin handlers 🛠 (HTTP DTO mapping in place)
-11. `internal/server` — Gin router, route registration, graceful shutdown ✅
-12. `cmd/serve.go`, `cmd/config.go`, `cmd/status.go` ✅ (serve done)
-13. Integration tests 🛠 (authenticated register → login → upload → list → download route flow covered with a small file; authentication bypass, invalid token, concealed cross-user resources, strict delete, atomic refresh consumption, and file hierarchy race boundaries covered)
-14. Architecture boundary tests ✅
+## Future Candidates
 
-## Future
-
-| Feature | Status | Notes |
-|---------|--------|-------|
-| Image server | ⬜ plan | thumbnail generation |
-| Pastebin & code snippets | ⬜ plan | in sharing context |
-| S3 storage backend | ⬜ plan | new storage impl |
-| Nextcloud-compatible API | ⬜ plan | new handler layer on existing services |
+- S3 storage
+- Image thumbnails
+- Paste and code-snippet sharing
+- Nextcloud-compatible protocol adapters