Backend Architecture

src/
├── app.ts              # createApp() — builds Express WITHOUT listening
├── index.ts            # entry point — creates server, attaches WS, listens
├── arcjet.ts           # security middleware + WS protection instances
├── db/
│   ├── db.ts           # pg Pool + Drizzle client + SSL strategy
│   └── schema.ts       # matches + commentary tables
├── routes/
│   ├── matches.ts      # GET/POST /matches
│   └── commentary.ts   # GET/POST /matches/:id/commentary
├── validation/
│   ├── matches.ts      # Zod schemas + MATCH_STATUS constant
│   └── commentary.ts   # Zod schemas
├── utils/
│   ├── logger.ts       # Winston (console in prod, files in dev)
│   └── match-status.ts # derive scheduled/live/finished from timestamps
└── ws/
    └── server.ts       # WebSocket server, subscription registry, broadcast API

const sslEnabled = process.env.DATABASE_SSL !== 'false';
const rejectUnauthorized = process.env.DATABASE_SSL_REJECT_UNAUTHORIZED !== 'false';

export const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: sslEnabled ? { rejectUnauthorized } : false,
});