## ADDED Requirements

### Requirement: Service runs on .13:3020
The frontend SHALL run as a systemd user service (`where-woof.service`) on `.13`, listening on `:3020`, restarting on failure, with secrets from an EnvironmentFile (never in the repo).

#### Scenario: Service starts
- **WHEN** the service is enabled and started
- **THEN** the app listens on 192.168.20.13:3020 and responds 200 on `/`

#### Scenario: Crash recovery
- **WHEN** the process exits unexpectedly
- **THEN** systemd restarts it

### Requirement: Deployable artifact
A build + rsync step SHALL produce and transfer the binary, `templates/`, and `static/` to `/var/www/where-woof` on .13, with `static/uploads` writable by the service user.

#### Scenario: Fresh deploy
- **WHEN** the build+rsync runs against a clean target dir
- **THEN** the service runs the new binary with templates/static present and uploads writable

### Requirement: Caddy reachability
The saved Caddy block on .35 SHALL reverse-proxy `where-woof.com` and `where-woof.home.lab` to `.13:3020`.

#### Scenario: Proxied request
- **WHEN** `where-woof.home.lab` is resolved to .35 and requested
- **THEN** the response comes from the .13 service