refactor: backend standardization (service layer, validation, route splitting) + image cache and Scryfall API fixes

CHANGELOG.md

@@ -14,7 +14,38 @@ This format follows Keep a Changelog principles and aims for Semantic Versioning
   - Telemetry decorators for route access tracking and error logging
   - Route pattern documentation defining standards for all routes
   - Split monolithic build route handler into focused, maintainable modules
+  - Step-based wizard routes consolidated into dedicated module
+  - New build flow and quick build automation extracted into focused module
+  - Alternative card suggestions extracted to standalone module
+  - Compliance/enforcement and card replacement extracted to focused module
   - Foundation for integrating custom exceptions into web layer
+- **Service Layer Architecture**: Base classes, interfaces, and registry for service standardization
+  - `BaseService`, `StateService`, `DataService`, `CachedService` abstract base classes
+  - Service protocols/interfaces for type-safe dependency injection
+  - `ServiceRegistry` for singleton/factory/lazy service patterns
+  - `SessionManager` refactored from global dict to thread-safe `StateService`
+- **Validation Framework**: Centralized Pydantic models and validators
+  - Pydantic models for all key request types (`BuildRequest`, `CommanderSearchRequest`, etc.)
+  - `CardNameValidator` with normalization for diacritics, punctuation, multi-face cards
+  - `ThemeValidator`, `PowerBracketValidator`, `ColorIdentityValidator`
+  - `ValidationMessages` class for consistent user-facing error messages
+
+### Fixed
+- **Image Cache Status UI**: Setup page status stuck on "Checking…"
+  - Stale `.download_status.json` from a failed run caused indefinite spinner
+  - Added error state handling in JS to show "Last download failed" with message
+  - Status endpoint now auto-cleans stale file after download completion/failure
+  - Last download result persisted to `.last_download_result.json` across restarts
+  - Card count now shown correctly (was double-counting by summing both size variants)
+  - Shows "+N new cards" from last download run
+- **Scryfall Bulk Data API**: HTTP 400 error when triggering image download
+  - Scryfall now requires `Accept: application/json` on API endpoints
+  - Fixed `ScryfallBulkDataClient._make_request()` to include the header
+
+### Removed
+- **Permalink Feature**: Removed permalink generation and restoration functionality
+  - Deemed unnecessary for single-session deck building workflow
+  - Users can still export decks (CSV/TXT/JSON) or use headless configs for automation
 - **Template Validation Tests**: Comprehensive test suite for HTML/Jinja2 templates
   - Validates Jinja2 syntax across all templates
   - Checks HTML structure (balanced tags, unique IDs, proper attributes)
@@ -98,6 +129,10 @@ This format follows Keep a Changelog principles and aims for Semantic Versioning
   - Optimized linting rules for development workflow
 
 ### Fixed
+- **Deck Summary Display**: Fixed issue where deck summary cards would not display correctly in manual builds
+  - Card images and names now appear properly in both List and Thumbnails views
+  - Commander card displayed correctly in Step 5 sidebar
+  - Summary data now properly persists across wizard stages
 - **Multi-Copy Package Detection**: Fixed bug preventing multi-copy suggestions from appearing in New Deck wizard
   - Corrected key mismatch between archetype definitions ('tagsAny') and detection code ('tags_any')
   - Multi-copy panel now properly displays when commander and theme tags match supported archetypes (e.g., Hare Apparent for Rabbit Kindred + Tokens Matter)