refactor: purge Node.js, Rust is the one true backend

- Moved boosapi-rs/* to repo root
- Deleted all Node.js source (src/server/, src/web/, scripts/)
- Deleted node_modules, package.json, tsconfig, vite.config
- Updated .gitignore and AGENTS.md for Rust-only stack
- Fixed static file path for frontend dist/web/
- Dockerfile stays the same (already Rust-only)
- Kept dist/web/ for Rust static serving

src/db/queries/mod.rs

@@ -0,0 +1,40 @@
+use crate::{
+    db::models::{downstream_api_key::DownstreamApiKey, user::User},
+    error::AppResult,
+};
+use sqlx::SqlitePool;
+
+pub async fn find_user_by_id(db: &SqlitePool, id: i64) -> AppResult<Option<User>> {
+    sqlx::query_as("SELECT * FROM users WHERE id = ?")
+        .bind(id)
+        .fetch_optional(db)
+        .await
+        .map_err(Into::into)
+}
+
+pub async fn find_user_by_email(db: &SqlitePool, email: &str) -> AppResult<Option<User>> {
+    sqlx::query_as("SELECT * FROM users WHERE email = ?")
+        .bind(email)
+        .fetch_optional(db)
+        .await
+        .map_err(Into::into)
+}
+
+pub async fn list_user_api_keys(db: &SqlitePool, user_id: i64) -> AppResult<Vec<DownstreamApiKey>> {
+    sqlx::query_as("SELECT * FROM downstream_api_keys WHERE user_id = ? ORDER BY created_at DESC")
+        .bind(user_id)
+        .fetch_all(db)
+        .await
+        .map_err(Into::into)
+}
+
+pub async fn find_downstream_key_by_token(
+    db: &SqlitePool,
+    token: &str,
+) -> AppResult<Option<DownstreamApiKey>> {
+    sqlx::query_as("SELECT * FROM downstream_api_keys WHERE key = ?")
+        .bind(token)
+        .fetch_optional(db)
+        .await
+        .map_err(Into::into)
+}