feat: book commenting system with upvote/downvote + fix profile SSR crash

- Add book_comments and comment_votes PocketBase collections (pb-init.sh + pocketbase.go EnsureCollections)
- Web: CommentsSection.svelte with post form, vote buttons, lazy-loaded per-book
- API routes: GET/POST /api/comments/[slug], POST /api/comments/[id]/vote
- iOS: BookComment + CommentsResponse models, fetchComments/postComment/voteComment in APIClient, CommentsView + CommentsViewModel wired into BookDetailView
- Fix profile page SSR crash (ERR_MODULE_NOT_FOUND cropperjs): lazy-load AvatarCropModal via dynamic import guarded by browser, move URL.createObjectURL into onMount

ui/src/lib/components/AvatarCropModal.svelte

@@ -13,9 +13,10 @@
 
 	let imgEl: HTMLImageElement;
 	let cropper: Cropper | null = null;
-	const objectUrl = URL.createObjectURL(file);
+	let objectUrl = $state('');
 
 	onMount(() => {
+		objectUrl = URL.createObjectURL(file);
 		cropper = new Cropper(imgEl, {
 			aspectRatio: 1,
 			viewMode: 1,

ui/src/lib/components/CommentsSection.svelte

@@ -0,0 +1,254 @@
+<script lang="ts">
+	interface BookComment {
+		id: string;
+		slug: string;
+		user_id: string;
+		username: string;
+		body: string;
+		upvotes: number;
+		downvotes: number;
+		created: string;
+	}
+
+	let {
+		slug,
+		isLoggedIn = false
+	}: {
+		slug: string;
+		isLoggedIn?: boolean;
+	} = $props();
+
+	// ── State ─────────────────────────────────────────────────────────────────
+	let comments = $state<BookComment[]>([]);
+	let myVotes = $state<Record<string, 'up' | 'down'>>({});
+	let loading = $state(true);
+	let loadError = $state('');
+
+	let newBody = $state('');
+	let posting = $state(false);
+	let postError = $state('');
+
+	// Per-comment vote inflight set (prevents double-clicks)
+	let votingIds = $state(new Set<string>());
+
+	// ── Load comments on mount ────────────────────────────────────────────────
+	async function loadComments() {
+		loading = true;
+		loadError = '';
+		try {
+			const res = await fetch(`/api/comments/${encodeURIComponent(slug)}`);
+			if (!res.ok) throw new Error(`${res.status}`);
+			const data = await res.json();
+			comments = data.comments ?? [];
+			myVotes = data.myVotes ?? {};
+		} catch (e) {
+			loadError = 'Failed to load comments.';
+		} finally {
+			loading = false;
+		}
+	}
+
+	// Run once on component mount via $effect
+	$effect(() => {
+		loadComments();
+	});
+
+	// ── Post comment ──────────────────────────────────────────────────────────
+	async function postComment() {
+		const text = newBody.trim();
+		if (!text || posting) return;
+		if (text.length > 2000) {
+			postError = 'Comment is too long (max 2000 characters).';
+			return;
+		}
+		posting = true;
+		postError = '';
+		try {
+			const res = await fetch(`/api/comments/${encodeURIComponent(slug)}`, {
+				method: 'POST',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ body: text })
+			});
+			if (res.status === 401) {
+				postError = 'You must be logged in to comment.';
+				return;
+			}
+			if (!res.ok) {
+				const err = await res.json().catch(() => ({}));
+				postError = err.message ?? 'Failed to post comment.';
+				return;
+			}
+			const created: BookComment = await res.json();
+			comments = [created, ...comments];
+			newBody = '';
+		} catch {
+			postError = 'Failed to post comment.';
+		} finally {
+			posting = false;
+		}
+	}
+
+	// ── Vote ──────────────────────────────────────────────────────────────────
+	async function vote(commentId: string, v: 'up' | 'down') {
+		if (votingIds.has(commentId)) return;
+		votingIds = new Set([...votingIds, commentId]);
+		try {
+			const res = await fetch(`/api/comments/${commentId}/vote`, {
+				method: 'POST',
+				headers: { 'Content-Type': 'application/json' },
+				body: JSON.stringify({ vote: v })
+			});
+			if (!res.ok) return;
+			const updated: BookComment = await res.json();
+			// Update comment in list
+			comments = comments.map((c) => (c.id === commentId ? updated : c));
+			// Update myVotes: toggle off if same, else set new vote
+			const prev = myVotes[commentId];
+			if (prev === v) {
+				const next = { ...myVotes };
+				delete next[commentId];
+				myVotes = next;
+			} else {
+				myVotes = { ...myVotes, [commentId]: v };
+			}
+		} finally {
+			const next = new Set(votingIds);
+			next.delete(commentId);
+			votingIds = next;
+		}
+	}
+
+	// ── Helpers ───────────────────────────────────────────────────────────────
+	function formatDate(iso: string): string {
+		try {
+			return new Date(iso).toLocaleDateString(undefined, {
+				year: 'numeric',
+				month: 'short',
+				day: 'numeric'
+			});
+		} catch {
+			return iso;
+		}
+	}
+
+	const charCount = $derived(newBody.length);
+	const charOver = $derived(charCount > 2000);
+</script>
+
+<div class="mt-10">
+	<h2 class="text-base font-semibold text-zinc-200 mb-4">
+		Comments
+		{#if !loading && comments.length > 0}
+			<span class="text-zinc-500 font-normal text-sm ml-1">({comments.length})</span>
+		{/if}
+	</h2>
+
+	<!-- Post form -->
+	<div class="mb-6">
+		{#if isLoggedIn}
+			<div class="flex flex-col gap-2">
+				<textarea
+					bind:value={newBody}
+					placeholder="Write a comment…"
+					rows="3"
+					class="w-full px-3 py-2 rounded-lg bg-zinc-800 border border-zinc-700 text-zinc-200 text-sm placeholder-zinc-500 resize-none focus:outline-none focus:border-amber-400 transition-colors"
+				></textarea>
+				<div class="flex items-center justify-between gap-3">
+					<span class="text-xs {charOver ? 'text-red-400' : 'text-zinc-600'} tabular-nums">
+						{charCount}/2000
+					</span>
+					<div class="flex items-center gap-3">
+						{#if postError}
+							<span class="text-xs text-red-400">{postError}</span>
+						{/if}
+						<button
+							onclick={postComment}
+							disabled={posting || !newBody.trim() || charOver}
+							class="px-4 py-1.5 rounded-lg text-sm font-medium transition-colors
+								{posting || !newBody.trim() || charOver
+									? 'bg-zinc-700 text-zinc-500 cursor-not-allowed'
+									: 'bg-amber-400 text-zinc-900 hover:bg-amber-300'}"
+						>
+							{posting ? 'Posting…' : 'Post'}
+						</button>
+					</div>
+				</div>
+			</div>
+		{:else}
+			<p class="text-sm text-zinc-500">
+				<a href="/auth/login" class="text-amber-400 hover:text-amber-300 transition-colors">Log in</a>
+				to leave a comment.
+			</p>
+		{/if}
+	</div>
+
+	<!-- Comment list -->
+	{#if loading}
+		<div class="flex flex-col gap-3">
+			{#each Array(3) as _}
+				<div class="rounded-lg bg-zinc-800/50 p-4 animate-pulse">
+					<div class="h-3 w-24 bg-zinc-700 rounded mb-3"></div>
+					<div class="h-3 w-full bg-zinc-700/60 rounded mb-2"></div>
+					<div class="h-3 w-3/4 bg-zinc-700/60 rounded"></div>
+				</div>
+			{/each}
+		</div>
+	{:else if loadError}
+		<p class="text-sm text-red-400">{loadError}</p>
+	{:else if comments.length === 0}
+		<p class="text-sm text-zinc-500">No comments yet. Be the first!</p>
+	{:else}
+		<div class="flex flex-col gap-3">
+			{#each comments as comment (comment.id)}
+				{@const myVote = myVotes[comment.id]}
+				{@const voting = votingIds.has(comment.id)}
+				<div class="rounded-lg bg-zinc-800/50 border border-zinc-700/50 px-4 py-3 flex flex-col gap-2">
+					<!-- Header: username + date -->
+					<div class="flex items-center gap-2 flex-wrap">
+						<span class="text-sm font-medium text-zinc-200">{comment.username || 'Anonymous'}</span>
+						<span class="text-zinc-600 text-xs">&middot;</span>
+						<span class="text-xs text-zinc-500">{formatDate(comment.created)}</span>
+					</div>
+
+					<!-- Body -->
+					<p class="text-sm text-zinc-300 leading-relaxed whitespace-pre-wrap break-words">{comment.body}</p>
+
+					<!-- Vote row -->
+					<div class="flex items-center gap-3 pt-1">
+						<!-- Upvote -->
+						<button
+							onclick={() => vote(comment.id, 'up')}
+							disabled={voting}
+							title="Upvote"
+							class="flex items-center gap-1 text-xs transition-colors disabled:opacity-50
+								{myVote === 'up'
+									? 'text-amber-400'
+									: 'text-zinc-500 hover:text-zinc-300'}"
+						>
+							<svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+								<path stroke-linecap="round" stroke-linejoin="round" d="M14 10h4.764a2 2 0 011.789 2.894l-3.5 7A2 2 0 0115.263 21h-4.017c-.163 0-.326-.02-.485-.06L7 20m7-10V5a2 2 0 00-2-2h-.095c-.5 0-.905.405-.905.905 0 .714-.211 1.412-.608 2.006L7 11v9m7-10h-2M7 20H5a2 2 0 01-2-2v-6a2 2 0 012-2h2.5"/>
+							</svg>
+							<span class="tabular-nums">{comment.upvotes ?? 0}</span>
+						</button>
+
+						<!-- Downvote -->
+						<button
+							onclick={() => vote(comment.id, 'down')}
+							disabled={voting}
+							title="Downvote"
+							class="flex items-center gap-1 text-xs transition-colors disabled:opacity-50
+								{myVote === 'down'
+									? 'text-red-400'
+									: 'text-zinc-500 hover:text-zinc-300'}"
+						>
+							<svg class="w-3.5 h-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" stroke-width="2">
+								<path stroke-linecap="round" stroke-linejoin="round" d="M10 14H5.236a2 2 0 01-1.789-2.894l3.5-7A2 2 0 018.736 3h4.018a2 2 0 01.485.06l3.76.94m-7 10v5a2 2 0 002 2h.096c.5 0 .905-.405.905-.904 0-.715.211-1.413.608-2.008L17 13V4m-7 10h2m5-10h2a2 2 0 012 2v6a2 2 0 01-2 2h-2.5"/>
+							</svg>
+							<span class="tabular-nums">{comment.downvotes ?? 0}</span>
+						</button>
+					</div>
+				</div>
+			{/each}
+		</div>
+	{/if}
+</div>

ui/src/lib/server/pocketbase.ts

@@ -811,3 +811,184 @@ export async function updateUserAvatarUrl(userId: string, avatarUrl: string): Pr
 		throw new Error(`updateUserAvatarUrl failed: ${res.status} ${body}`);
 	}
 }
+
+// ─── Comments ─────────────────────────────────────────────────────────────────
+
+export interface BookComment {
+	id: string;
+	slug: string;
+	user_id: string;
+	username: string;
+	body: string;
+	upvotes: number;
+	downvotes: number;
+	created: string;
+}
+
+export interface CommentVote {
+	id: string;
+	comment_id: string;
+	user_id: string;
+	session_id: string;
+	vote: 'up' | 'down';
+}
+
+/**
+ * List comments for a book, newest first, up to 100.
+ */
+export async function listComments(slug: string): Promise<BookComment[]> {
+	const token = await getToken();
+	const filter = encodeURIComponent(`slug="${slug.replace(/"/g, '\\"')}"`);
+	const res = await fetch(
+		`${PB_URL}/api/collections/book_comments/records?filter=${filter}&sort=-created&perPage=100`,
+		{ headers: { Authorization: `Bearer ${token}` } }
+	);
+	if (!res.ok) return [];
+	const data = await res.json();
+	return (data.items ?? []) as BookComment[];
+}
+
+/**
+ * Create a new comment. Returns the created record.
+ */
+export async function createComment(
+	slug: string,
+	body: string,
+	userId: string | undefined,
+	username: string
+): Promise<BookComment> {
+	const token = await getToken();
+	const res = await fetch(`${PB_URL}/api/collections/book_comments/records`, {
+		method: 'POST',
+		headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+		body: JSON.stringify({
+			slug,
+			body,
+			user_id: userId ?? '',
+			username,
+			upvotes: 0,
+			downvotes: 0,
+			created: new Date().toISOString()
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => '');
+		throw new Error(`createComment failed: ${res.status} ${text}`);
+	}
+	return res.json() as Promise<BookComment>;
+}
+
+/**
+ * Get an existing vote by this voter (identified by user_id or session_id) on a comment.
+ */
+export async function getCommentVote(
+	commentId: string,
+	sessionId: string,
+	userId?: string
+): Promise<CommentVote | null> {
+	const token = await getToken();
+	const voterFilter = userId
+		? `comment_id="${commentId}"&&user_id="${userId}"`
+		: `comment_id="${commentId}"&&session_id="${sessionId}"`;
+	const res = await fetch(
+		`${PB_URL}/api/collections/comment_votes/records?filter=${encodeURIComponent(voterFilter)}&perPage=1`,
+		{ headers: { Authorization: `Bearer ${token}` } }
+	);
+	if (!res.ok) return null;
+	const data = await res.json();
+	const items = (data.items ?? []) as CommentVote[];
+	return items[0] ?? null;
+}
+
+/**
+ * Cast or change a vote on a comment. Handles:
+ * - New vote: creates vote record, increments counter.
+ * - Same vote again: removes it (toggle off), decrements counter.
+ * - Changed vote: updates record, adjusts both counters.
+ * Returns the updated comment.
+ */
+export async function voteComment(
+	commentId: string,
+	vote: 'up' | 'down',
+	sessionId: string,
+	userId?: string
+): Promise<BookComment> {
+	const token = await getToken();
+
+	// Fetch current comment
+	const commentRes = await fetch(`${PB_URL}/api/collections/book_comments/records/${commentId}`, {
+		headers: { Authorization: `Bearer ${token}` }
+	});
+	if (!commentRes.ok) throw new Error(`Comment not found: ${commentId}`);
+	const comment = (await commentRes.json()) as BookComment;
+
+	const existing = await getCommentVote(commentId, sessionId, userId);
+
+	let upDelta = 0;
+	let downDelta = 0;
+
+	if (!existing) {
+		// New vote
+		await fetch(`${PB_URL}/api/collections/comment_votes/records`, {
+			method: 'POST',
+			headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+			body: JSON.stringify({ comment_id: commentId, user_id: userId ?? '', session_id: sessionId, vote })
+		});
+		vote === 'up' ? upDelta++ : downDelta++;
+	} else if (existing.vote === vote) {
+		// Toggle off — remove vote
+		await fetch(`${PB_URL}/api/collections/comment_votes/records/${existing.id}`, {
+			method: 'DELETE',
+			headers: { Authorization: `Bearer ${token}` }
+		});
+		vote === 'up' ? upDelta-- : downDelta--;
+	} else {
+		// Changed vote
+		await fetch(`${PB_URL}/api/collections/comment_votes/records/${existing.id}`, {
+			method: 'PATCH',
+			headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+			body: JSON.stringify({ vote })
+		});
+		if (vote === 'up') { upDelta++; downDelta--; }
+		else { upDelta--; downDelta++; }
+	}
+
+	// Patch comment counters
+	const patchRes = await fetch(`${PB_URL}/api/collections/book_comments/records/${commentId}`, {
+		method: 'PATCH',
+		headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+		body: JSON.stringify({
+			upvotes: Math.max(0, (comment.upvotes ?? 0) + upDelta),
+			downvotes: Math.max(0, (comment.downvotes ?? 0) + downDelta)
+		})
+	});
+	if (!patchRes.ok) throw new Error(`Failed to update vote counts on comment ${commentId}`);
+	return patchRes.json() as Promise<BookComment>;
+}
+
+/**
+ * Fetch votes cast by this session/user, keyed by comment_id.
+ * Returns a map of commentId → 'up' | 'down'.
+ */
+export async function getMyVotes(
+	commentIds: string[],
+	sessionId: string,
+	userId?: string
+): Promise<Record<string, 'up' | 'down'>> {
+	if (commentIds.length === 0) return {};
+	const token = await getToken();
+	const idFilter = commentIds.map((id) => `comment_id="${id}"`).join('||');
+	const voterPart = userId ? `user_id="${userId}"` : `session_id="${sessionId}"`;
+	const filter = encodeURIComponent(`(${idFilter})&&${voterPart}`);
+	const res = await fetch(
+		`${PB_URL}/api/collections/comment_votes/records?filter=${filter}&perPage=200`,
+		{ headers: { Authorization: `Bearer ${token}` } }
+	);
+	if (!res.ok) return {};
+	const data = await res.json();
+	const map: Record<string, 'up' | 'down'> = {};
+	for (const v of (data.items ?? []) as CommentVote[]) {
+		map[v.comment_id] = v.vote as 'up' | 'down';
+	}
+	return map;
+}

ui/src/routes/api/comments/[id]/vote/+server.ts

@@ -0,0 +1,33 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { voteComment } from '$lib/server/pocketbase';
+import { log } from '$lib/server/logger';
+
+/**
+ * POST /api/comments/[id]/vote
+ * Body: { vote: 'up' | 'down' }
+ * Casts, changes, or toggles off a vote on a comment.
+ * Works for both authenticated and anonymous users (session-scoped).
+ * Returns the updated comment.
+ */
+export const POST: RequestHandler = async ({ params, request, locals }) => {
+	const { id } = params;
+	let body: { vote?: string };
+	try {
+		body = await request.json();
+	} catch {
+		error(400, 'Invalid JSON body');
+	}
+
+	if (body.vote !== 'up' && body.vote !== 'down') {
+		error(400, 'vote must be "up" or "down"');
+	}
+
+	try {
+		const updated = await voteComment(id, body.vote, locals.sessionId, locals.user?.id);
+		return json(updated);
+	} catch (e) {
+		log.error('api/comments/[id]/vote', 'voteComment failed', { id, err: String(e) });
+		error(500, 'Failed to record vote');
+	}
+};

ui/src/routes/api/comments/[slug]/+server.ts

@@ -0,0 +1,54 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { listComments, createComment, getMyVotes } from '$lib/server/pocketbase';
+import { log } from '$lib/server/logger';
+
+/**
+ * GET /api/comments/[slug]
+ * Returns comments for a book + the current visitor's votes.
+ * Response: { comments: BookComment[], myVotes: Record<string, 'up'|'down'> }
+ */
+export const GET: RequestHandler = async ({ params, locals }) => {
+	const { slug } = params;
+	try {
+		const comments = await listComments(slug);
+		const myVotes = await getMyVotes(
+			comments.map((c) => c.id),
+			locals.sessionId,
+			locals.user?.id
+		);
+		return json({ comments, myVotes });
+	} catch (e) {
+		log.error('api/comments/[slug]', 'listComments failed', { slug, err: String(e) });
+		error(500, 'Failed to load comments');
+	}
+};
+
+/**
+ * POST /api/comments/[slug]
+ * Body: { body: string }
+ * Creates a new comment. Requires authentication.
+ */
+export const POST: RequestHandler = async ({ params, request, locals }) => {
+	if (!locals.user) error(401, 'Login required to comment');
+
+	const { slug } = params;
+	let body: { body?: string };
+	try {
+		body = await request.json();
+	} catch {
+		error(400, 'Invalid JSON body');
+	}
+
+	const text = (body.body ?? '').trim();
+	if (!text) error(400, 'Comment body is required');
+	if (text.length > 2000) error(400, 'Comment is too long (max 2000 characters)');
+
+	try {
+		const comment = await createComment(slug, text, locals.user.id, locals.user.username);
+		return json(comment, { status: 201 });
+	} catch (e) {
+		log.error('api/comments/[slug]', 'createComment failed', { slug, err: String(e) });
+		error(500, 'Failed to post comment');
+	}
+};

ui/src/routes/books/[slug]/+page.svelte

@@ -2,6 +2,7 @@
 	import { onMount } from 'svelte';
 	import { invalidateAll } from '$app/navigation';
 	import type { PageData } from './$types';
+	import CommentsSection from '$lib/components/CommentsSection.svelte';
 
 	let { data }: { data: PageData } = $props();
 
@@ -525,3 +526,6 @@
 		</div>
 	{/if}
 </div>
+
+<!-- ══════════════════════════════════════════════════ Comments ══ -->
+<CommentsSection slug={data.book.slug} isLoggedIn={true} />

ui/src/routes/profile/+page.svelte

@@ -3,7 +3,7 @@
 	import { invalidateAll } from '$app/navigation';
 	import type { PageData, ActionData } from './$types';
 	import { audioStore } from '$lib/audio.svelte';
-	import AvatarCropModal from '$lib/components/AvatarCropModal.svelte';
+	import { browser } from '$app/environment';
 
 	let { data, form }: { data: PageData; form: ActionData } = $props();
 
@@ -213,12 +213,14 @@
 	<title>Profile — libnovel</title>
 </svelte:head>
 
-{#if cropFile}
-	<AvatarCropModal
-		file={cropFile}
-		onconfirm={handleCropConfirm}
-		oncancel={handleCropCancel}
-	/>
+{#if cropFile && browser}
+	{#await import('$lib/components/AvatarCropModal.svelte') then { default: AvatarCropModal }}
+		<AvatarCropModal
+			file={cropFile}
+			onconfirm={handleCropConfirm}
+			oncancel={handleCropCancel}
+		/>
+	{/await}
 {/if}
 
 <!-- Hidden logout form used when user ends their own session -->