Add multi-account OAuth, Obsidian integration, product assets, and test tooling

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

product/site/server.mjs

@@ -0,0 +1,68 @@
+import http from "node:http";
+import { createReadStream, existsSync } from "node:fs";
+import { stat } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = __dirname;
+const port = Number(process.env.PRODUCT_SITE_PORT || 4173);
+const host = "127.0.0.1";
+
+const contentTypes = {
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+};
+
+function resolvePath(urlPath) {
+  const cleanPath = decodeURIComponent(urlPath.split("?")[0]);
+  const relativePath = cleanPath === "/" ? "/index.html" : cleanPath;
+  const absolutePath = path.normalize(path.join(root, relativePath));
+  if (!absolutePath.startsWith(root)) {
+    return null;
+  }
+  // Try with .html extension for clean URLs (e.g. /privacy → privacy.html)
+  const withHtml = absolutePath + ".html";
+  if (!existsSync(absolutePath) && existsSync(withHtml)) return withHtml;
+  return absolutePath;
+}
+
+const server = http.createServer(async (req, res) => {
+  const filePath = resolvePath(req.url || "/");
+  if (!filePath) {
+    res.writeHead(403);
+    res.end("Forbidden");
+    return;
+  }
+
+  try {
+    const fileStat = await stat(filePath);
+    if (!fileStat.isFile()) {
+      res.writeHead(404);
+      res.end("Not found");
+      return;
+    }
+  } catch {
+    const fallback = path.join(root, "index.html");
+    if (existsSync(fallback)) {
+      res.writeHead(200, { "Content-Type": contentTypes[".html"] });
+      createReadStream(fallback).pipe(res);
+      return;
+    }
+    res.writeHead(404);
+    res.end("Not found");
+    return;
+  }
+
+  const ext = path.extname(filePath).toLowerCase();
+  res.writeHead(200, {
+    "Content-Type": contentTypes[ext] || "application/octet-stream",
+  });
+  createReadStream(filePath).pipe(res);
+});
+
+server.listen(port, host, () => {
+  console.log(`SquareMCP product site running at http://${host}:${port}`);
+});