Backend Phase C: Sync-Kern + Caddy behind-proxy

Sync-Kern:
- internal/sync/hlc.go: Hybrid Logical Clock (wall_ms<<16|counter)
  Tick/Now/After, global mutex, strikt monoton + kausal korrekt
- internal/sync/hlc_test.go: Unit-Tests (monoton, kausal, keine Duplikate)

Store-Schicht:
- internal/store/opstore.go: AppendOps idempotent via UNIQUE(client_id,
  client_seq) ON CONFLICT DO NOTHING; LWW-Projektion (list_create/
  rename/delete, item_add/update/remove) in derselben Transaktion;
  PullOps mit Cursor (seq > since, 500er Pages)
- internal/store/liststore.go: CreateList / GetLists / GetList
- internal/store/itemstore.go: GetItems (nicht-gelöschte Items)
- internal/store/suggeststore.go: Search (pg_trgm + LIKE-fallback, 10)

HTTP-Handler:
- internal/httpapi/lists.go: GET/POST /api/lists, GET /api/lists/{id}
- internal/httpapi/ops.go: POST /api/lists/{id}/ops (Push),
  GET /api/lists/{id}/ops (Pull ?since=)
- internal/httpapi/suggest.go: GET /api/suggestions?q=
- internal/httpapi/api.go: alle Routen verdrahtet (RequireAuth)

Deployment:
- deploy/Caddyfile.behind-proxy: auto_https off, trusted_proxies
- deploy/Caddyfile: X-Forwarded-Proto hinzugefügt, Kommentar aktualisiert
- deploy/docker-compose.yml: CADDY_HTTP_PORT + CADDY_HTTPS_PORT
- deploy/.env.example: Caddy-Port-Variablen dokumentiert

go build ./... && go vet ./... && go test ./... ✅
HLC-Tests: monoton, kausal, keine Duplikate ✅
AGENTS.md: Phase C vollständig ✅

backend/internal/httpapi/api.go

@@ -7,36 +7,48 @@ import (
 
 	"github.com/mitbringsl/backend/internal/auth"
 	"github.com/mitbringsl/backend/internal/config"
+	"github.com/mitbringsl/backend/internal/store"
 )
 
 // API bundles all handler groups and wires the router.
-// Handler groups are added in subsequent phases (lists, items, suggestions).
 type API struct {
 	cfg  *config.Config
 	pool *pgxpool.Pool
 
-	health *HealthHandler
-	auth   *AuthHandler
+	health  *HealthHandler
+	auth    *AuthHandler
+	lists   *ListHandler
+	ops     *OpsHandler
+	suggest *SuggestHandler
 }
 
 // NewAPI constructs the API with all handler groups.
 func NewAPI(cfg *config.Config, pool *pgxpool.Pool) *API {
+	// Auth stores
 	users := auth.NewUserStore(pool)
 	sessions := auth.NewSessionStore(pool, auth.SessionConfig{
 		TokenBytes: cfg.SessionTokenBytes,
 		TTL:        cfg.SessionTokenTTL,
 	})
 	oidcSvc := auth.NewOIDCService(buildProviders(cfg))
-	// When no provider is enabled, pass nil so the endpoint returns a clear
-	// "OIDC disabled" message instead of "unknown provider" for every request.
 	if len(oidcSvc.Providers()) == 0 {
 		oidcSvc = nil
 	}
+
+	// Sync stores
+	listStore := store.NewListStore(pool)
+	itemStore := store.NewItemStore(pool)
+	opStore := store.NewOpStore(pool)
+	suggestStore := store.NewSuggestStore(pool)
+
 	return &API{
-		cfg:    cfg,
-		pool:   pool,
-		health: &HealthHandler{Pool: pool},
-		auth:   NewAuthHandler(users, sessions, oidcSvc, cfg),
+		cfg:     cfg,
+		pool:    pool,
+		health:  &HealthHandler{Pool: pool},
+		auth:    NewAuthHandler(users, sessions, oidcSvc, cfg),
+		lists:   NewListHandler(listStore, itemStore),
+		ops:     NewOpsHandler(opStore, listStore),
+		suggest: NewSuggestHandler(suggestStore),
 	}
 }
 
@@ -67,11 +79,13 @@ func (a *API) Handler() http.Handler {
 	mux.HandleFunc("POST /auth/oidc", a.auth.OIDC)
 	mux.HandleFunc("POST /auth/logout", a.auth.Logout)
 
-	// --- authenticated API endpoints (added in Phase C) ---
-	// mux.HandleFunc("GET /api/lists", a.RequireAuth(http.HandlerFunc(a.lists.List)))
-	// mux.HandleFunc("GET /api/lists/{id}/ops", a.RequireAuth(http.HandlerFunc(a.items.PullOps)))
-	// mux.HandleFunc("POST /api/lists/{id}/ops", a.RequireAuth(http.HandlerFunc(a.items.PushOps)))
-	// mux.HandleFunc("GET /api/suggestions", a.RequireAuth(http.HandlerFunc(a.suggest.Suggest)))
+	// --- authenticated API endpoints ---
+	mux.Handle("GET /api/lists",           a.RequireAuth(http.HandlerFunc(a.lists.List)))
+	mux.Handle("POST /api/lists",          a.RequireAuth(http.HandlerFunc(a.lists.Create)))
+	mux.Handle("GET /api/lists/{id}",      a.RequireAuth(http.HandlerFunc(a.lists.Get)))
+	mux.Handle("POST /api/lists/{id}/ops", a.RequireAuth(http.HandlerFunc(a.ops.Push)))
+	mux.Handle("GET /api/lists/{id}/ops",  a.RequireAuth(http.HandlerFunc(a.ops.Pull)))
+	mux.Handle("GET /api/suggestions",     a.RequireAuth(http.HandlerFunc(a.suggest.Search)))
 
 	return Chain(
 		mux,