feat(routes-f): add devices recap drops and chapters endpoints

[CMI-James]

Description

Implemented a single routes-f delivery for all four requested issues: push notification devices, stream recap summaries, stream drops/giveaways, and live stream chapter markers.

Closes #482
Closes #484
Closes #485
Closes #486

Changes proposed

What were you told to do?

Implement all four standalone routes-f endpoints and ship them together as one PR, pushed to upstream dev:

• devices registration/listing/unregistration
• post-stream recap summary
• drops and giveaways
• live stream chapter markers

What did I do?

Push notification devices (#486)

• Added GET and POST in app/api/routes-f/devices/route.ts.
• Added DELETE in app/api/routes-f/devices/[id]/route.ts.
• Enforced max 5 devices per user.
• Implemented token upsert by token hash.
• Stored tokens encrypted at rest (AES-256-GCM).

Stream recap summary (#482)

• Added GET /api/routes-f/stream/recap?stream_id= in app/api/routes-f/stream/recap/route.ts.
• Returns 404 if stream is missing or still live.
• Computes recap metrics (peak viewers, avg viewers, watch minutes, tips, followers, top gifters, chat count, duration).
• Added recap caching table and response cache header Cache-Control: public, max-age=86400.

Drops and giveaways (#485)

• Added GET and POST in app/api/routes-f/drops/route.ts.
• Added entry endpoint POST /api/routes-f/drops/[id]/enter.
• Added draw endpoint POST /api/routes-f/drops/[id]/draw.
• Enforced one entry per viewer.
• Auto-closes expired drops.
• Uses server-side random winner selection with crypto.getRandomValues.

Live stream chapter markers (#484)

• Added GET and POST in app/api/routes-f/stream/chapters/route.ts.
• Added DELETE in app/api/routes-f/stream/chapters/[id]/route.ts.
• Enforced owner-only create/delete.
• Enforced timestamp_seconds <= current elapsed stream time.
• Enforced max 50 chapters per stream.

Hook-required type fix on dev branch

• Updated app/api/routes-f/leaderboard/route.ts to satisfy strict type-check on dev.

Check List (Check all the applicable boxes)

• My code follows the code style of this project.
• This PR does not contain plagiarized content.
• The title and description of the PR is clear and explains the approach.
• I am making a pull request against the main branch (left side).
• My commit messages styles matches our requested structure.
• My code additions will fail neither code linting checks nor unit test.
• I am only making changes to files I was requested to.

Screenshots / Testing Evidence

• npm run build passed (includes npm run type-check and production Next build)
• npm test -- --runInBand passed (28 suites, 282 tests)
• Commit hooks were not bypassed (--no-verify not used)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
streamfi-frontend	Ready	Preview, Comment	Mar 28, 2026 1:44pm

[drips-wave]

@CMI-James Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits