feat: add Swagger UI docs, custom CORS middleware, and request logging

- Add Swagger UI files and updated API spec for Family Safety Tracker
- Replace shelf_cors_headers with custom CORS middleware in server.dart
- Add request_logger middleware with timing for auth and geo routes
- Add REGISTRATION_SECRET_KEY to .env for registration validation
- Remove postgres port exposure from docker-compose.yml
- Update opencode.json model configuration
- Add crypto dependency and update Flutter web assets

bin/server.dart

@@ -4,13 +4,29 @@ import 'dart:async';
 import 'package:shelf/shelf.dart';
 import 'package:shelf/shelf_io.dart';
 import 'package:shelf_router/shelf_router.dart';
-import 'package:shelf_cors_headers/shelf_cors_headers.dart';
 import 'package:shelf_static/shelf_static.dart';
 
 import 'database/database_provider.dart';
 import 'routes/auth_routes.dart';
 import 'routes/geo_routes.dart';
 
+Middleware _corsMiddleware = (Handler innerHandler) {
+  return (Request request) {
+    final headers = <String, String>{
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+      'Access-Control-Max-Age': '86400',
+    };
+
+    if (request.method == 'OPTIONS') {
+      return Response.ok(null, headers: headers);
+    }
+
+    return Future.value(innerHandler(request)).then((response) => response.change(headers: headers));
+  };
+};
+
 void main(List<String> args) async {
   final database = DatabaseProvider();
   await database.initialize();
@@ -22,16 +38,18 @@ void main(List<String> args) async {
   final authRoutes = AuthRoutes(database);
   final geoRoutes = GeoRoutes(database);
 
-  final router = Router()
+ final router = Router()
     ..mount('/', authRoutes.routes.call)
     ..mount('/', geoRoutes.routes.call);
 
   final staticHandler = createStaticHandler('web', defaultDocument: 'index.html');
+  final apiHandler  = createStaticHandler('web/swagger', defaultDocument: 'index.html');
 
   final handler = Pipeline()
-      .addMiddleware(corsHeaders())
+      .addMiddleware(_corsMiddleware)
       .addMiddleware(logRequests())
       .addHandler(Cascade()
+          .add(apiHandler)
           .add(staticHandler)
           .add(router.call)
           .handler);