Phlashy/what-to-watch-tonight

This is a well-kept little full-stack app. The test coverage is surprisingly strong for a personal/family tool, the Express routes are mostly clean, and there’s good attention to deployment realities like /movie-night/ base paths, SQLite migrations, optional auth, rate limiting, and Pi/Nginx docs. Lint passes, and the full test suite passes after installing both root and server dependencies.

A few refinements I’d make:
Scope list item updates/deletes to the list name in the URL. Right now those routes use only itemId, so a request under one list can affect an item from another list if the id is known.
Treat chat tool mutations as a two-step action. The prompt says “confirm first,” but the server currently executes the model’s add/remove list tool calls directly. A pending-action confirmation flow would make that safer.
Run npm audit fix for the dev-only form-data advisory. Production deps are clean, but the lockfile still reports one high-severity dev advisory.