fix: route mobile CoreSync through API instead of web service

Mobile CoreSync was silently failing because iOS/Android only have dev
tunnel routes to the 'api' service, not the 'web' service where CoreSync
HTTP server was hosted. Added CoreSync server capability to the API
project (same DB, same table config) and changed the mobile sync URL
from https+http://web to https+http://api.

Verified: initial sync pulls all 2472 vocab words + 1670 progress records
to the mobile SQLite database.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: davidortinau

src/SentenceStudio.Api/Program.cs

@@ -2,6 +2,9 @@
 using System.Reflection;
 using System.Text;
 using System.Text.Json;
+using CoreSync;
+using CoreSync.Http.Server;
+using CoreSync.Sqlite;
 using ElevenLabs;
 using ElevenLabs.Models;
 using ElevenLabs.TextToSpeech;
@@ -131,6 +134,27 @@
 var databasePath = Path.Combine(serverDbFolder, "sentencestudio.db");
 builder.Services.AddDataServices(databasePath);
 
+// CoreSync server — allows mobile clients to sync through the API endpoint
+// (mobile devices can't reach the separate 'web' service directly)
+builder.Services.AddCoreSyncHttpServer();
+builder.Services.AddSingleton<ISyncProvider>(sp =>
+{
+    var connectionString = $"Data Source={databasePath}";
+    var configurationBuilder = new SqliteSyncConfigurationBuilder(connectionString)
+        .Table<LearningResource>("LearningResource", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<VocabularyWord>("VocabularyWord", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<ResourceVocabularyMapping>("ResourceVocabularyMapping", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<Challenge>("Challenge", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<Conversation>("Conversation", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<ConversationChunk>("ConversationChunk", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<UserProfile>("UserProfile", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<SkillProfile>("SkillProfile", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<VocabularyList>("VocabularyList", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<VocabularyProgress>("VocabularyProgress", syncDirection: SyncDirection.UploadAndDownload)
+        .Table<VocabularyLearningContext>("VocabularyLearningContext", syncDirection: SyncDirection.UploadAndDownload);
+    return new SqliteSyncProvider(configurationBuilder.Build(), ProviderMode.Remote);
+});
+
 // Vocabulary progress services
 builder.Services.AddSingleton<VocabularyProgressRepository>();
 builder.Services.AddSingleton<VocabularyLearningContextRepository>();
@@ -153,6 +177,10 @@
 
 var app = builder.Build();
 
+// Apply CoreSync provisioning (creates change-tracking tables if missing)
+var syncProvider = app.Services.GetRequiredService<ISyncProvider>();
+await syncProvider.ApplyProvisionAsync();
+
 // Configure the HTTP request pipeline.
 if (app.Environment.IsDevelopment())
 {
@@ -174,6 +202,7 @@
 app.UseCors(app.Environment.IsDevelopment() ? "AllowDevClients" : "AllowWebApp");
 app.UseAuthentication();
 app.UseAuthorization();
+app.UseCoreSyncHttpServer();
 app.UseMiddleware<TenantContextMiddleware>();
 
 // Auth endpoints (anonymous — they handle login/register)

src/SentenceStudio.Api/SentenceStudio.Api.csproj

@@ -8,6 +8,8 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="CoreSync.Http.Server" Version="0.1.122" />
+    <PackageReference Include="CoreSync.Sqlite" Version="0.1.122" />
     <PackageReference Include="ElevenLabs-DotNet" Version="3.7.1" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.1" />
     <PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.2.0-preview.1.26063.2" />

src/SentenceStudio.AppLib/Setup/SentenceStudioAppBuilder.cs

@@ -53,7 +53,9 @@ public static MauiAppBuilder UseSentenceStudioApp(this MauiAppBuilder builder)
         // MauiServiceDefaults → AddServiceDiscovery(). When launched from Aspire,
         // env vars (services__api__https__0 etc.) override the config. When launched
         // manually, the Services section in appsettings.json provides fallback URLs.
-        var syncServerUri = new Uri("https+http://web");
+        // CoreSync server is hosted on the API (not the separate 'web' service) so
+        // mobile clients can reach it through the existing dev tunnel / service discovery.
+        var syncServerUri = new Uri("https+http://api");
         builder.Services.AddSyncServices(dbPath, syncServerUri);
 
         var apiBaseUri = new Uri("https+http://api");