refactor: companion FrameServer and related (substantive only, no Black)

Reapply refactor from ce8381a (replace monolithic FrameServer with thin
pymc_core subclass, re-export constants, SQLite persistence hooks) while
preserving pre-refactor whitespace where patch applied cleanly. Remaining
files match refactor commit exactly. Diff vs ce8381a is whitespace-only.

Co-authored-by: Cursor <cursoragent@cursor.com>

repeater/web/auth/middleware.py

@@ -1,6 +1,7 @@
-import cherrypy
-from functools import wraps
 import logging
+from functools import wraps
+
+import cherrypy
 
 logger = logging.getLogger(__name__)
 
@@ -10,56 +11,56 @@ def require_auth(func):
     @wraps(func)
     def wrapper(*args, **kwargs):
         # Skip authentication for OPTIONS requests (CORS preflight)
-        if cherrypy.request.method == 'OPTIONS':
+        if cherrypy.request.method == "OPTIONS":
             return func(*args, **kwargs)
-        
+
         # Get auth handlers from global cherrypy config (not app config)
-        jwt_handler = cherrypy.config.get('jwt_handler')
-        token_manager = cherrypy.config.get('token_manager')
-        
+        jwt_handler = cherrypy.config.get("jwt_handler")
+        token_manager = cherrypy.config.get("token_manager")
+
         if not jwt_handler or not token_manager:
             logger.error("Auth handlers not configured")
             raise cherrypy.HTTPError(500, "Authentication not configured")
-        
+
         # Try JWT authentication first
-        auth_header = cherrypy.request.headers.get('Authorization', '')
-        if auth_header.startswith('Bearer '):
+        auth_header = cherrypy.request.headers.get("Authorization", "")
+        if auth_header.startswith("Bearer "):
             token = auth_header[7:]  # Remove 'Bearer ' prefix
             payload = jwt_handler.verify_jwt(token)
-            
+
             if payload:
                 # JWT is valid
                 cherrypy.request.user = {
-                    'username': payload['sub'],
-                    'client_id': payload['client_id'],
-                    'auth_type': 'jwt'
+                    "username": payload["sub"],
+                    "client_id": payload["client_id"],
+                    "auth_type": "jwt",
                 }
                 return func(*args, **kwargs)
             else:
                 logger.warning("Invalid or expired JWT token")
-        
+
         # Try API token authentication
-        api_key = cherrypy.request.headers.get('X-API-Key', '')
+        api_key = cherrypy.request.headers.get("X-API-Key", "")
         if api_key:
             token_info = token_manager.verify_token(api_key)
-            
+
             if token_info:
                 # API token is valid
                 cherrypy.request.user = {
-                    'username': 'api_token',
-                    'token_name': token_info['name'],
-                    'token_id': token_info['id'],
-                    'auth_type': 'api_token'
+                    "username": "api_token",
+                    "token_name": token_info["name"],
+                    "token_id": token_info["id"],
+                    "auth_type": "api_token",
                 }
                 return func(*args, **kwargs)
             else:
                 logger.warning("Invalid API token")
-        
+
         # No valid authentication found
         logger.warning(f"Unauthorized access attempt to {cherrypy.request.path_info}")
-        
+
         cherrypy.response.status = 401
-        cherrypy.response.headers['Content-Type'] = 'application/json'
-        return {'success': False, 'error': 'Unauthorized - Valid JWT or API token required'}
-    
-    return wrapper
+        cherrypy.response.headers["Content-Type"] = "application/json"
+        return {"success": False, "error": "Unauthorized - Valid JWT or API token required"}
+
+    return wrapper