Merge branch 'develop' into feature/statistics-api

# Conflicts:
#	internal/backend/music.go
#	internal/backend/sync.go
#	internal/server/server.go
#	internal/server/syncHandler.go
#	internal/server/sync_handler_test.go
#	internal/server/test_helpers.go
#	internal/server/zz_music_handler_test.go

internal/server/characterHandler.go

@@ -2,6 +2,7 @@ package server
 
 import (
 	"net/http"
+	"os"
 
 	"github.com/labstack/echo/v5"
 	"music-server/internal/backend"
@@ -38,5 +39,11 @@ func (c *CharacterHandler) GetCharacterList(ctx *echo.Context) error {
 // @Router /character [get]
 func (c *CharacterHandler) GetCharacter(ctx *echo.Context) error {
 	character := ctx.QueryParam("name")
-	return ctx.File(backend.GetCharacter(character))
+	characterPath := backend.GetCharacter(character)
+	file, err := os.Open(characterPath)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusNotFound, err.Error())
+	}
+	defer file.Close()
+	return ctx.Stream(http.StatusOK, "image/png", file)
 }

internal/server/routes.go

@@ -164,6 +164,33 @@ func (s *Server) RegisterRoutes() http.Handler {
 	// Future: VGMQ endpoints will be added to protectedV1 group
 	_ = protectedV1 // Use the variable to avoid unused variable error
 
+	// ============================================
+	// API v1 Routes with Token Authentication
+	// ============================================
+	
+	// Create /api/v1 group
+	apiV1 := e.Group("/api/v1")
+	
+	// Public endpoints - no token required
+	apiV1.POST("/token", func(c *echo.Context) error {
+		return s.tokenHandler.CreateTokenHandler(c)
+	})
+	apiV1.DELETE("/token", func(c *echo.Context) error {
+		return s.tokenHandler.DeleteTokenHandler(c)
+	})
+	apiV1.POST("/token/cleanup", func(c *echo.Context) error {
+		return s.tokenHandler.CleanupExpiredSessionsHandler(c)
+	})
+
+	// Protected endpoints - require valid token
+	// Create token auth middleware with pool access
+	tokenAuthMiddleware := middleware.TokenAuthMiddleware(s.db.Pool)
+
+	// Protected group with token authentication - will be used by VGMQ and Statistics API
+	_ = apiV1.Group("", tokenAuthMiddleware)
+
+	// Note: Future protected endpoints (VGMQ, Statistics) will be added here
+
 	routes := e.Router().Routes()
 	sort.Slice(routes, func(i, j int) bool {
 		return routes[i].Path < routes[j].Path

internal/server/syncHandler.go

@@ -49,6 +49,7 @@ func (s *SyncHandler) SyncSoundtracksNewOnlyChanges(ctx *echo.Context) error {
 		return ctx.JSON(http.StatusLocked, "Syncing is in progress")
 	}
 	logging.GetLogger().Info("Starting sync with only changes")
+	backend.Syncing = true
 	go backend.SyncSoundtracksNewOnlyChanges()
 	return ctx.JSON(http.StatusOK, "Start syncing soundtracks")
 }
@@ -68,6 +69,7 @@ func (s *SyncHandler) SyncSoundtracksNewFull(ctx *echo.Context) error {
 		return ctx.JSON(http.StatusLocked, "Syncing is in progress")
 	}
 	logging.GetLogger().Info("Starting full sync")
+	backend.Syncing = true
 	go backend.SyncSoundtracksNewFull()
 	return ctx.JSON(http.StatusOK, "Start syncing soundtracks full")
 }