implement proper Steam API endpoint for /steam/refresh

Fixed issue where backend was forwarding /steam/refresh to
store.steampowered.com instead of calling the actual Steam Web API.

Now properly calls:
https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/

With parameters from request body (apiKey, steamId).

Fixes 'the string did not match the expected pattern' error.

Co-Authored-By: Claude <noreply@anthropic.com>

server/index.js

@@ -19,8 +19,43 @@ app.get("/health", (req, res) => {
 	res.json({ status: "ok" });
 });
 
-// Proxy for Steam API
-// Note: Uberspace removes /api prefix, so we get /<path> here
+// Steam API refresh endpoint
+app.post("/steam/refresh", async (req, res) => {
+	const { apiKey, steamId } = req.body;
+
+	console.log(`Steam refresh for user: ${steamId}`);
+
+	if (!apiKey || !steamId) {
+		return res.status(400).json({
+			error: "Missing required fields: apiKey and steamId",
+		});
+	}
+
+	try {
+		// Call Steam Web API
+		const steamUrl = `https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=${apiKey}&steamid=${steamId}&include_appinfo=1&include_played_free_games=1&format=json`;
+
+		const response = await fetch(steamUrl);
+
+		if (!response.ok) {
+			return res.status(response.status).json({
+				error: "Steam API error",
+				message: response.statusText,
+			});
+		}
+
+		const data = await response.json();
+		res.json(data);
+	} catch (error) {
+		console.error("Steam API error:", error);
+		res.status(500).json({
+			error: "Failed to fetch games",
+			message: error.message,
+		});
+	}
+});
+
+// Fallback proxy for other Steam API calls
 app.all("/*", async (req, res) => {
 	const path = req.url;
 	const steamUrl = `https://store.steampowered.com${path}`;