feat: major platform expansion — Brain service, RSS reader, iOS app, AI assistants, Firefox extension

Brain Service:
- Playwright stealth crawler replacing browserless (og:image, Readability, Reddit JSON API)
- AI classification with tag definitions and folder assignment
- YouTube video download via yt-dlp
- Karakeep migration complete (96 items)
- Taxonomy management (folders with icons/colors, tags)
- Discovery shuffle, sort options, search (Meilisearch + pgvector)
- Item tag/folder editing, card color accents

RSS Reader Service:
- Custom FastAPI reader replacing Miniflux
- Feed management (add/delete/refresh), category support
- Full article extraction via Readability
- Background content fetching for new entries
- Mark all read with confirmation
- Infinite scroll, retention cleanup (30/60 day)
- 17 feeds migrated from Miniflux

iOS App (SwiftUI):
- Native iOS 17+ app with @Observable architecture
- Cookie-based auth, configurable gateway URL
- Dashboard with custom background photo + frosted glass widgets
- Full fitness module (today/templates/goals/food library)
- AI assistant chat (fitness + brain, raw JSON state management)
- 120fps ProMotion support

AI Assistants (Gateway):
- Unified dispatcher with fitness/brain domain detection
- Fitness: natural language food logging, photo analysis, multi-item splitting
- Brain: save/append/update/delete notes, search & answer, undo support
- Madiha user gets fitness-only (brain disabled)

Firefox Extension:
- One-click save to Brain from any page
- Login with platform credentials
- Right-click context menu (save page/link/image)
- Notes field for URL saves
- Signed and published on AMO

Other:
- Reader bookmark button routes to Brain (was Karakeep)
- Fitness food library with "Add" button + add-to-meal popup
- Kindle send file size check (25MB SMTP2GO limit)
- Atelier UI as default (useAtelierShell=true)
- Mobile upload box in nav drawer

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gateway/Dockerfile

@@ -3,7 +3,7 @@ WORKDIR /app
 RUN pip install --no-cache-dir bcrypt
 RUN adduser --disabled-password --no-create-home appuser
 RUN mkdir -p /app/data && chown -R appuser /app/data
-COPY --chown=appuser server.py config.py database.py sessions.py proxy.py responses.py auth.py dashboard.py command.py ./
+COPY --chown=appuser server.py config.py database.py sessions.py proxy.py responses.py auth.py dashboard.py command.py assistant.py ./
 COPY --chown=appuser integrations/ ./integrations/
 EXPOSE 8100
 ENV PYTHONUNBUFFERED=1

gateway/config.py

@@ -17,6 +17,7 @@ INVENTORY_URL = os.environ.get("INVENTORY_BACKEND_URL", "http://localhost:4499")
 NOCODB_API_TOKEN = os.environ.get("NOCODB_API_TOKEN", "")
 MINIFLUX_URL = os.environ.get("MINIFLUX_URL", "http://localhost:8767")
 MINIFLUX_API_KEY = os.environ.get("MINIFLUX_API_KEY", "")
+READER_URL = os.environ.get("READER_BACKEND_URL", "http://reader-api:8300")
 TRIPS_API_TOKEN = os.environ.get("TRIPS_API_TOKEN", "")
 SHELFMARK_URL = os.environ.get("SHELFMARK_URL", "http://shelfmark:8084")
 SPOTIZERR_URL = os.environ.get("SPOTIZERR_URL", "http://spotizerr-app:7171")

gateway/database.py

@@ -8,7 +8,7 @@ import bcrypt
 
 from config import (
     DB_PATH, TRIPS_URL, FITNESS_URL, INVENTORY_URL,
-    MINIFLUX_URL, SHELFMARK_URL, SPOTIZERR_URL, BUDGET_URL, TASKS_URL, BRAIN_URL,
+    MINIFLUX_URL, READER_URL, SHELFMARK_URL, SPOTIZERR_URL, BUDGET_URL, TASKS_URL, BRAIN_URL,
 )
 
 
@@ -94,9 +94,13 @@ def init_db():
     # Ensure reader app exists
     rdr = c.execute("SELECT id FROM apps WHERE id = 'reader'").fetchone()
     if not rdr:
-        c.execute("INSERT INTO apps VALUES ('reader', 'Reader', 'rss', '/reader', ?, 4, 1, 'unread_count')", (MINIFLUX_URL,))
+        c.execute("INSERT INTO apps VALUES ('reader', 'Reader', 'rss', '/reader', ?, 4, 1, 'unread_count')", (READER_URL,))
         conn.commit()
         print("[Gateway] Added reader app")
+    else:
+        # Update existing reader app to point to new service
+        c.execute("UPDATE apps SET proxy_target = ? WHERE id = 'reader'", (READER_URL,))
+        conn.commit()
 
     # Ensure books app exists (now media)
     books = c.execute("SELECT id FROM apps WHERE id = 'books'").fetchone()

gateway/integrations/kindle.py

@@ -90,8 +90,15 @@ def handle_send_to_kindle(handler, book_id: str, body: bytes):
     title = meta.get("title", "Book") if meta else "Book"
     author = ", ".join(meta.get("authors", [])) if meta else ""
 
-    # Read file and encode as base64
+    # Read file and check size
     file_data = file_path.read_bytes()
+    size_mb = len(file_data) / (1024 * 1024)
+    if size_mb > 25:
+        handler._send_json({
+            "error": f"File too large for email ({size_mb:.1f} MB). SMTP2GO limit is 25 MB. Use the Kindle app or USB instead.",
+            "size_mb": round(size_mb, 1),
+        }, 413)
+        return
     file_b64 = base64.b64encode(file_data).decode("ascii")
     filename = file_path.name
 
@@ -133,7 +140,9 @@ def handle_send_to_kindle(handler, book_id: str, body: bytes):
                 "size": len(file_data),
             })
         else:
-            handler._send_json({"error": "Email send failed", "detail": result}, 500)
+            failures = result.get("data", {}).get("failures", [])
+            detail = failures[0] if failures else str(result)
+            handler._send_json({"error": f"Email send failed: {detail}"}, 500)
     except Exception as e:
         handler._send_json({"error": f"SMTP2GO error: {str(e)}"}, 500)
 
@@ -175,6 +184,13 @@ def handle_send_file_to_kindle(handler, body: bytes):
         return
 
     file_data = file_path.read_bytes()
+    size_mb = len(file_data) / (1024 * 1024)
+    if size_mb > 25:
+        handler._send_json({
+            "error": f"File too large for email ({size_mb:.1f} MB). SMTP2GO limit is 25 MB. Use the Kindle app or USB instead.",
+            "size_mb": round(size_mb, 1),
+        }, 413)
+        return
     file_b64 = base64.b64encode(file_data).decode("ascii")
 
     ext = file_path.suffix.lower()

gateway/proxy.py

@@ -56,7 +56,7 @@ def resolve_service(path):
     remainder = "/" + "/".join(parts[3:]) if len(parts) > 3 else "/"
     # Services that don't use /api prefix (Express apps, etc.)
     NO_API_PREFIX_SERVICES = {"inventory", "music", "budget"}
-    SERVICE_PATH_PREFIX = {"reader": "/v1"}
+    SERVICE_PATH_PREFIX = {}
     if service_id in SERVICE_PATH_PREFIX:
         backend_path = f"{SERVICE_PATH_PREFIX[service_id]}{remainder}"
     elif service_id in NO_API_PREFIX_SERVICES:

gateway/server.py

@@ -25,6 +25,7 @@ from dashboard import (
     handle_set_connection, handle_pin, handle_unpin, handle_get_pinned,
 )
 from command import handle_command
+from assistant import handle_assistant, handle_fitness_assistant, handle_brain_assistant
 from integrations.booklore import (
     handle_booklore_libraries, handle_booklore_import,
     handle_booklore_books, handle_booklore_cover,
@@ -242,6 +243,24 @@ class GatewayHandler(ResponseMixin, BaseHTTPRequestHandler):
                 handle_command(self, user, body)
             return
 
+        if path == "/api/assistant":
+            user = self._require_auth()
+            if user:
+                handle_assistant(self, body, user)
+            return
+
+        if path == "/api/assistant/fitness":
+            user = self._require_auth()
+            if user:
+                handle_fitness_assistant(self, body, user)
+            return
+
+        if path == "/api/assistant/brain":
+            user = self._require_auth()
+            if user:
+                handle_brain_assistant(self, body, user)
+            return
+
         if path.startswith("/api/"):
             self._proxy("POST", path, body)
             return
@@ -290,8 +309,10 @@ class GatewayHandler(ResponseMixin, BaseHTTPRequestHandler):
             headers["Content-Type"] = ct
 
         # Inject service-level auth
-        if service_id == "reader" and MINIFLUX_API_KEY:
-            headers["X-Auth-Token"] = MINIFLUX_API_KEY
+        if service_id == "reader":
+            if user:
+                headers["X-Gateway-User-Id"] = str(user["id"])
+                headers["X-Gateway-User-Name"] = user.get("display_name", user.get("username", ""))
         elif service_id == "trips" and TRIPS_API_TOKEN:
             headers["Authorization"] = f"Bearer {TRIPS_API_TOKEN}"
         elif service_id == "inventory" and INVENTORY_SERVICE_API_KEY: