add icon token subdir, Docker, SPEC/AGENTS, initial commit

README.md

@@ -0,0 +1,31 @@
+# IDRS API
+
+Python (FastAPI + SQLite) server that mirrors the live idrs-api endpoints, with a login-protected admin panel to manage the data.
+
+- `GET /api/getTokenInfo` → token list (position ASC, `decimals` int, `is_live` bool)
+- `GET /api/version/android` → version record
+- `GET /img/<filename>` → uploaded token icons
+- `/admin` → sqladmin panel (login-protected): manage tokens, version, upload icons
+
+## Setup
+
+```
+python3.12 -m venv venv
+./venv/bin/pip install -r requirements.txt
+cp .env.example .env   # set ADMIN_USERNAME / ADMIN_PASSWORD
+```
+
+## Run
+
+```
+./run.sh            # http://127.0.0.1:8000  (admin at /admin)
+```
+
+`run.sh` loads `.env`. First run seeds the DB from `tokenList.json` and `versionAndroid.json` (idrs.db is created here; override path via `IDRS_DB_PATH`).
+
+## Notes
+
+- **Auth:** single admin, credentials from `ADMIN_USERNAME`/`ADMIN_PASSWORD` env. If they're unset, login is refused and a warning is logged (fail closed). Session secret is auto-generated on first run and stored in `.session_secret`. The public API endpoints stay unauthenticated.
+- **Version rule:** `acceptableVersion` ≤ `latestVersion` is enforced in the panel; below `acceptableVersion` the Android app force-updates, below `latestVersion` it prompts.
+- **Icons:** upload PNGs in the admin panel (Icons page); `iconUrl` auto-points to `/img/<filename>`.
+- No on-chain integration, no audit trail — data is entered manually.