chore: phase 1 nativephp foundation setup

legacy-system-audit.md

@@ -0,0 +1,90 @@
+# Legacy System Audit (Retraced)
+
+## Scope used for this audit
+
+- `../dewemoji-api` (backend)
+- `../dewemoji-chrome-ext` (chrome extension)
+- `../dewemoji-site` (website)
+
+## 1) Current reality by folder
+
+### A) `dewemoji-api` (backend, currently functional)
+- Contains working API routes and working web pages (`index.html`, `api-docs.html`).
+- API files:
+  - `api/index.php`
+  - `api/emojis.php`
+  - `api/emoji.php`
+- Helpers:
+  - `helpers/auth.php`
+  - `helpers/filters.php`
+- Data pipeline:
+  - `tools/build-emojis.js`
+  - data in `data/*.json`
+- Apache rewrite and security rules in `.htaccess`.
+
+### B) `dewemoji-chrome-ext` (active extension)
+- Manifest V3 extension with side panel UI.
+- Main files:
+  - `manifest.json`
+  - `panel.js`, `panel.html`, `styles.css`
+  - `background.js`, `content.js`
+- Uses remote API `https://api.dewemoji.com/v1`.
+
+### C) `dewemoji-site` (website repo, currently scaffold)
+- Folder exists with expected site structure (`index.php`, `api-docs.php`, `assets/`, `data/`, `helpers/`, etc.).
+- Almost all files are currently **empty (0 bytes)**.
+- Current state indicates scaffold/template placeholder, not active website logic.
+
+## 2) Dataset snapshot (from `dewemoji-api`)
+
+- Source: `../dewemoji-api/data/emojis.json`
+- Emojis: **1910**
+- Categories: **10** (`Activities`, `Animals & Nature`, `Component`, `Flags`, `Food & Drink`, `Objects`, `People & Body`, `Smileys & Emotion`, `Symbols`, `Travel & Places`)
+- Subcategories: **99**
+
+## 3) Feature inventory
+
+### Backend/API (implemented in `dewemoji-api`)
+- Public read API with pagination/filtering.
+- `GET /api/emojis`
+- `GET /api/emoji/{slug}`
+- `GET /api/categories`
+- CORS enabled for GET/OPTIONS.
+- IP rate limit in router (60 requests / 60 seconds).
+- ETag and cache headers.
+
+### Chrome extension (implemented in `dewemoji-chrome-ext`)
+- Search, category/subcategory filters.
+- Free/Pro mode UX.
+- License activation check flow.
+- Copy / insert / auto mode.
+- Skin tone preference + lock.
+- Side panel and keyboard toggle command.
+- Client cache + daily free usage tracking.
+
+### Website (`dewemoji-site`)
+- Not implemented yet (empty files).
+- Current working website behavior still lives in `dewemoji-api` HTML/JS pages.
+
+## 4) Important mismatches and risks
+
+1. Query param mismatch in backend list endpoint:
+- `api/emojis.php` reads `query`.
+- Docs/client examples often send `q`.
+
+2. Backend license validators are stubs:
+- `isValidGumroad()` and `isValidMayar()` return `false`.
+- Tier in this PHP backend effectively falls back to free.
+
+3. Contract split:
+- Backend folder exposes `/api/*`.
+- Extension expects `/v1/*` on `api.dewemoji.com`.
+
+4. Website source-of-truth gap:
+- `dewemoji-site` is currently empty scaffold, so active website behavior is still in `dewemoji-api`.
+
+## 5) Folder health snapshot
+
+- `dewemoji-api`: 20 files, 20 non-empty (~4.3 MB)
+- `dewemoji-chrome-ext`: 13 files, 13 non-empty (~135 KB)
+- `dewemoji-site`: 40 files, 1 non-empty (`.gitignore`), rest empty scaffold