This PR breaks the large web and player bootstrap files into smaller modules with clearer ownership.

Web changes:

Split shared helpers, bootstrap logic, route groups, and upload-sync behavior out of web.js.
Kept web.js focused on wiring and server startup.
Fixed screen playlist reassignment so changing a screen’s playlist now triggers a refresh.
Fixed single-slide playlist refresh behavior so updates do not get stuck behind the current slide.
Player changes:

Split websocket/runtime handling into runtime.js.
Split playlist assembly and revision hashing into playlist.js.
Split onboarding and player HTTP routes into dedicated modules.
Split render utilities and template loading into render-helpers.js.
Kept player.js mostly as startup/orchestration.
Validation:

Rebuilt both services with Docker Compose.
Smoke-checked web and player routes after the refactor.
Verified get_errors was clean on the touched modules.

src/web/session.js

@@ -0,0 +1,102 @@
+function createSessionService(options) {
+  const sessionCookieName = String(options && options.sessionCookieName || '').trim();
+  const sessionMaxAgeMs = Number(options && options.sessionMaxAgeMs);
+  const hashSessionToken = options && options.hashSessionToken;
+  const createSessionToken = options && options.createSessionToken;
+
+  if (!sessionCookieName || !Number.isFinite(sessionMaxAgeMs) || typeof hashSessionToken !== 'function' || typeof createSessionToken !== 'function') {
+    throw new Error('createSessionService requires the session dependencies.');
+  }
+
+  function parseCookies(cookieHeader) {
+    return String(cookieHeader || '').split(/;\s*/).reduce(function (cookies, pair) {
+      if (!pair) {
+        return cookies;
+      }
+      const separatorIndex = pair.indexOf('=');
+      if (separatorIndex === -1) {
+        return cookies;
+      }
+      const name = decodeURIComponent(pair.slice(0, separatorIndex).trim());
+      const value = decodeURIComponent(pair.slice(separatorIndex + 1).trim());
+      if (name) {
+        cookies[name] = value;
+      }
+      return cookies;
+    }, {});
+  }
+
+  function serializeCookie(name, value, options) {
+    const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+    if (options && options.maxAge !== undefined) {
+      parts.push(`Max-Age=${Math.max(0, Math.trunc(Number(options.maxAge) / 1000))}`);
+    }
+    parts.push('Path=/');
+    parts.push('HttpOnly');
+    parts.push('SameSite=Lax');
+    return parts.join('; ');
+  }
+
+  function clearSessionCookie(res) {
+    res.setHeader('Set-Cookie', serializeCookie(sessionCookieName, '', { maxAge: 0 }));
+  }
+
+  function setSessionCookie(res, token) {
+    res.setHeader('Set-Cookie', serializeCookie(sessionCookieName, token, { maxAge: sessionMaxAgeMs }));
+  }
+
+  async function loadCurrentUser(pool, req) {
+    const cookies = parseCookies(req.headers.cookie || '');
+    const token = cookies[sessionCookieName];
+    if (!token) {
+      return null;
+    }
+
+    const tokenHash = hashSessionToken(token);
+    const [rows] = await pool.query(
+      `SELECT s.user_id, u.id, u.name, u.username
+       FROM auth_sessions s
+       JOIN users u ON u.id = s.user_id
+       WHERE s.session_hash = ?
+         AND s.expires_at > NOW()
+       LIMIT 1`,
+      [tokenHash]
+    );
+    if (!rows.length) {
+      return null;
+    }
+
+    await pool.query('UPDATE auth_sessions SET last_used_at = CURRENT_TIMESTAMP, modified_by = ? WHERE session_hash = ?', [rows[0].user_id, tokenHash]);
+    return rows[0];
+  }
+
+  async function createUserSession(pool, userId) {
+    const token = createSessionToken();
+    const tokenHash = hashSessionToken(token);
+    const expiresAt = new Date(Date.now() + sessionMaxAgeMs);
+    await pool.query(
+      'INSERT INTO auth_sessions (session_hash, user_id, expires_at, created_by, modified_by) VALUES (?, ?, ?, ?, ?)',
+      [tokenHash, userId, expiresAt, userId, userId]
+    );
+    return token;
+  }
+
+  function requireAuth(req, res, next) {
+    if (req.currentUser) {
+      return next();
+    }
+    res.redirect('/login?message=' + encodeURIComponent('Please sign in to continue.'));
+  }
+
+  return {
+    parseCookies: parseCookies,
+    serializeCookie: serializeCookie,
+    clearSessionCookie: clearSessionCookie,
+    setSessionCookie: setSessionCookie,
+    loadCurrentUser: loadCurrentUser,
+    createUserSession: createUserSession,
+    requireAuth: requireAuth
+  };
+}
+
+module.exports = { createSessionService };