Watches

- package.json had empty dependencies{} so npm install was a no-op; restored
  all 54 deps from package-lock.json so the project is installable fresh
- added "type":"module" and corrected main/start entries (server.js, not index.js)
- server.js hardcoded PORT=7600 ignoring the PORT env var; changed to
  process.env.PORT with 7600 fallback so pm2/test runners can override the port

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

loadWatches() was doing `allWatches = await response.json()` against
/api/watches, but server.js:442 returns `{total, page, limit, totalPages, watches: [...]}`
(default limit=50). So allWatches was getting the wrapper object, and every
subsequent .forEach/.filter on it was broken (silently — Array.prototype
methods don't exist on plain objects so the comparison list on index.html
was non-functional).

Defensive fix: extract .watches if the response is an object (handles old
bare-array API too), and request ?limit=9999 so we still get the whole
catalog now that the endpoint paginates.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Returns plain 404 for any request matching editor or merge-leftover
extensions before reaching express.static. Backstop in case a snapshot
file ever lands inside dist/ or public/ via deploy/rsync.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api-playground.html had three target=_blank quick-links without rel
attrs (window.opener exploit risk pre-2021 browsers). Added rel on all
three. The "Full Guide" link points at /docs/API_COMPLETE_GUIDE.md but
no static handler served /docs — added express.static for ./docs with
text/markdown content-type so the link no longer dead-404s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Unknown /api/* paths were being swallowed by the app.get('*') fallback
that serves dist/index.html, so a typo'd API URL returned the React shell
(200 with HTML) instead of a proper 404. JSON 404 makes API misuse
detectable on the client + in logs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds *.bak.*, *.pre-*, *.orig, *.rej plus SQLite WAL/SHM/journal so the
search FTS db's transient sidecar files don't show up as untracked.
*~ and *.swp already covered under IDE block above.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Sort hydrates BEFORE first /api/advanced-search call. Default sort flipped
from "relevance" to "Newest (Year)". Density slider rewrites a CSS var so
the auto-fill min card width updates without re-rendering.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>