feat: major platform expansion — Brain service, RSS reader, iOS app, AI assistants, Firefox extension

Brain Service:
- Playwright stealth crawler replacing browserless (og:image, Readability, Reddit JSON API)
- AI classification with tag definitions and folder assignment
- YouTube video download via yt-dlp
- Karakeep migration complete (96 items)
- Taxonomy management (folders with icons/colors, tags)
- Discovery shuffle, sort options, search (Meilisearch + pgvector)
- Item tag/folder editing, card color accents

RSS Reader Service:
- Custom FastAPI reader replacing Miniflux
- Feed management (add/delete/refresh), category support
- Full article extraction via Readability
- Background content fetching for new entries
- Mark all read with confirmation
- Infinite scroll, retention cleanup (30/60 day)
- 17 feeds migrated from Miniflux

iOS App (SwiftUI):
- Native iOS 17+ app with @Observable architecture
- Cookie-based auth, configurable gateway URL
- Dashboard with custom background photo + frosted glass widgets
- Full fitness module (today/templates/goals/food library)
- AI assistant chat (fitness + brain, raw JSON state management)
- 120fps ProMotion support

AI Assistants (Gateway):
- Unified dispatcher with fitness/brain domain detection
- Fitness: natural language food logging, photo analysis, multi-item splitting
- Brain: save/append/update/delete notes, search & answer, undo support
- Madiha user gets fitness-only (brain disabled)

Firefox Extension:
- One-click save to Brain from any page
- Login with platform credentials
- Right-click context menu (save page/link/image)
- Notes field for URL saves
- Signed and published on AMO

Other:
- Reader bookmark button routes to Brain (was Karakeep)
- Fitness food library with "Add" button + add-to-meal popup
- Kindle send file size check (25MB SMTP2GO limit)
- Atelier UI as default (useAtelierShell=true)
- Mobile upload box in nav drawer

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

gateway/server.py

@@ -25,6 +25,7 @@ from dashboard import (
     handle_set_connection, handle_pin, handle_unpin, handle_get_pinned,
 )
 from command import handle_command
+from assistant import handle_assistant, handle_fitness_assistant, handle_brain_assistant
 from integrations.booklore import (
     handle_booklore_libraries, handle_booklore_import,
     handle_booklore_books, handle_booklore_cover,
@@ -242,6 +243,24 @@ class GatewayHandler(ResponseMixin, BaseHTTPRequestHandler):
                 handle_command(self, user, body)
             return
 
+        if path == "/api/assistant":
+            user = self._require_auth()
+            if user:
+                handle_assistant(self, body, user)
+            return
+
+        if path == "/api/assistant/fitness":
+            user = self._require_auth()
+            if user:
+                handle_fitness_assistant(self, body, user)
+            return
+
+        if path == "/api/assistant/brain":
+            user = self._require_auth()
+            if user:
+                handle_brain_assistant(self, body, user)
+            return
+
         if path.startswith("/api/"):
             self._proxy("POST", path, body)
             return
@@ -290,8 +309,10 @@ class GatewayHandler(ResponseMixin, BaseHTTPRequestHandler):
             headers["Content-Type"] = ct
 
         # Inject service-level auth
-        if service_id == "reader" and MINIFLUX_API_KEY:
-            headers["X-Auth-Token"] = MINIFLUX_API_KEY
+        if service_id == "reader":
+            if user:
+                headers["X-Gateway-User-Id"] = str(user["id"])
+                headers["X-Gateway-User-Name"] = user.get("display_name", user.get("username", ""))
         elif service_id == "trips" and TRIPS_API_TOKEN:
             headers["Authorization"] = f"Bearer {TRIPS_API_TOKEN}"
         elif service_id == "inventory" and INVENTORY_SERVICE_API_KEY: