feat: complete v0.3 reading and discovery experience

app/api/bookmarks/route.ts

@@ -0,0 +1,16 @@
+import { NextResponse } from "next/server";
+import { requireUser } from "@/lib/auth";
+import { db } from "@/lib/db";
+import { externalUrl } from "@/lib/http";
+
+export async function POST(req: Request) {
+  try {
+    const user = await requireUser(); const form = await req.formData(); const postId = Number(form.get("postId")); const kind = String(form.get("kind"));
+    if (!postId || !["saved", "later"].includes(kind)) throw new Error("Invalid bookmark");
+    const post = db.prepare("SELECT id FROM posts WHERE id=? AND visibility='PUBLIC' AND hidden=0").get(postId); if (!post) throw new Error("Post not found");
+    const existing = db.prepare("SELECT kind FROM bookmarks WHERE user_id=? AND post_id=?").get(user.id, postId) as { kind: string } | undefined;
+    if (existing?.kind === kind) db.prepare("DELETE FROM bookmarks WHERE user_id=? AND post_id=?").run(user.id, postId);
+    else db.prepare("INSERT INTO bookmarks(user_id,post_id,kind) VALUES(?,?,?) ON CONFLICT(user_id,post_id) DO UPDATE SET kind=excluded.kind,created_at=CURRENT_TIMESTAMP").run(user.id, postId, kind);
+    return NextResponse.redirect(externalUrl(req, `/posts/${postId}`));
+  } catch { return NextResponse.redirect(externalUrl(req, "/")); }
+}