- `create_app()` — Flask-only factory for unit tests (no ManagementMiddleware)
-
- `build_app()` — Full WSGI app with ManagementMiddleware for production/Gunicorn
+
Single `create_app()` factory returns the fully-wrapped WSGI app. Module-level `application = create_app()` for Gunicorn (`app.platform_server:application`).
-
Currently `test_management_ui.py` uses `_create_flask_app()` and `test_auth_server.py` uses `create_app()`. Both should map to the new `create_app()`. 3 test files, ~46 import callsites (mechanical).
+
- Auth server applies ProxyFix inside Flask; API server applies it outermost. Consolidated app: apply once, outermost (api_server pattern).
+
- Tests call `create_app(db_path=..., ...)` with overrides as they do today.
+
- Actual import callsites across tests: ~17 (not ~46 as initially estimated). 3 test files, straightforward find-and-replace.
