Summary

• Switch AppShield from oidc_only to credentials_only auth mode to remove the Dex dependency that was causing 500 errors
• Add ALLOW_HASH_CONTENT_PATHS: "true" — AppShield's built-in flag for Stremio's 40-char hex streaming paths
• Replace hardcoded admin/stremio credentials with $DEFAULT_PWD
• Restore the x-casaos metadata block (main, architectures, author, developer, screenshot_link) that was previously lost
• Fix screenshot/thumbnail URLs to point to Yundera/AppStore@main
• Add rationale.md documenting the root container and auth deviations

Root Cause

The original Stremio app used appshield in oidc_only mode, which depends on Dex — a separate identity provider that can crash or lose its static IP (172.31.7.2) to auth-registrar on restart. When Dex is unavailable, AppShield returns 500 on every request, making Stremio completely inaccessible. This was reproduced on both a production server and a Yundera demo server.

Fix

• credentials_only mode removes the Dex dependency entirely while keeping AppShield authentication intact
• $DEFAULT_PWD uses the platform's per-user default password instead of a static hardcoded value
• ALLOW_HASH_CONTENT_PATHS=true is AppShield's documented mechanism for apps like Stremio that use hash-based paths as access tokens for streaming

Test Plan

• Fresh install — app loads immediately, no Dex/OIDC errors
• Login works with admin / Yundera default password
• Streaming works without auth errors on internal API paths
• Icon, screenshots, and thumbnail load correctly
• Tested on production and demo servers