Add Public API

README.md

@@ -15,7 +15,7 @@ The server listens on `http://localhost:8080` by default.
 - `PORT`: HTTP port, default `8080`
 - `HOST`: bind address, default `0.0.0.0`
 - `DATA_DIR`: disk storage root, default `./data`
-- `SITE_URL`: public canonical site URL used for SEO metadata, sitemaps, feeds, and `llms.txt`
+- `SITE_URL`: public canonical site URL used for SEO metadata, sitemaps, feeds, `llms.txt`, OpenAPI servers, and API skill instructions. Production should use `https://bitsforfree.com`.
 - `SEED_DEMO_MEMES`: set to `false` to disable generated demo memes on first boot
 - `ADMIN_TOKEN`: secret review URL token. If omitted, one is generated at boot and printed in server logs.
 - `OPENAI_API_KEY`: enables AI upload moderation. Without it, uploads are queued for admin review.
@@ -38,6 +38,8 @@ data/
 
 The app serves crawler and answer-engine metadata without adding visible page copy:
 
+- `/openapi.json`
+- `/meme-api.skill.md`
 - `/robots.txt`
 - `/sitemap.xml` with the home page and approved meme URLs
 - `/feed.json`
@@ -45,7 +47,18 @@ The app serves crawler and answer-engine metadata without adding visible page co
 - `/site.webmanifest`
 - Open Graph, Twitter card, canonical, and JSON-LD metadata on `/`
 
-Set `SITE_URL` in production so canonical URLs use the public domain instead of an internal proxy hostname.
+Set `SITE_URL` in production so canonical and API discovery URLs use the public domain instead of an internal proxy hostname. The server loads `.env` at startup when present, while real environment variables still take precedence.
+
+## Public API
+
+- `GET /api/memes?page=1&pageSize=12`: lists approved memes only. `pageSize` is capped at `48`.
+- `GET /api/memes/<sha256>`: returns public metadata for one approved meme.
+- `GET /media/<sha256>`: returns the normalized WebP image for one approved meme.
+- `POST /api/memes`: submits one PNG/JPEG upload as `multipart/form-data` with a file field named `meme`.
+
+API uploads use the exact same path as the browser form: persistent IP upload quotas, file size checks, image dimension and pixel checks, metadata-stripping WebP normalization, AI moderation, and admin-review queueing. A published upload returns `201`; a queued upload returns `202`; moderation rejection returns `422`.
+
+Public API reads are rate-limited per IP and return `429` with `Retry-After` when exceeded. List and metadata responses include `RateLimit-*` headers and a `rateLimit` object.
 
 ## Docker