AGENTS.md: remember the e621 OpenAPI spec and the project constraints

Future sessions are told to fetch and grep https://e621.wiki/openapi.yaml
before touching e621 endpoints, with the response-shape gotchas we hit
(bare arrays vs wrapped objects, pool search parameters, the form-encoded
PATCH for user settings). The durable constraints — token auth, no
server-side media processing, no imgdd, no chat — are recorded too so a
compacted session cannot regress them.

AGENTS.md

@@ -5,3 +5,32 @@ DO NOT mess with the system's python
 For Frontend work:
 
 read both Frontend Design related Markdown files on the frontend/ folder
+
+For anything touching e621 endpoints or payloads (posts, pools, tags, users,
+favorites, IQDB, blacklists, uploads), consult the e621 OpenAPI spec first:
+    https://e621.wiki/openapi.yaml
+
+Download it once per session (it is ~450 KB YAML), then grep it for the exact
+path/parameter/schema names instead of guessing:
+
+    curl -sL https://e621.wiki/openapi.yaml -o /tmp/opencode/e621-openapi.yaml
+    grep -n "^  /pools.json" /tmp/opencode/e621-openapi.yaml
+
+Notes learned from the spec (verify before trusting):
+- Index endpoints often return a bare array (e.g. GET /pools.json) while the
+  show endpoint returns the object directly (e.g. GET /pools/{id}.json) — not
+  always wrapped in a named key.
+- Pools index supports search[order] (id_asc, id_desc, name, created_at,
+  post_count), search[name_matches], search[category], search[is_active].
+- Own settings (including user[blacklisted_tags]) are updated with
+  PATCH /users/{id}.json as form-encoded data; /users/me.json returns the user
+  object at the top level.
+
+Project constraints (do not regress):
+- Backend is Django 6 + DRF with token auth (no session auth on the API);
+  MariaDB/Redis come from docker-compose.yml.
+- No server-side media processing: the home server cannot handle it.
+  Compression/optimization runs client-side (WebCodecs + WASM in a worker)
+  and the server only applies the result via POST /api/files/J-x/optimize/.
+- Do not use imgdd; perceptual hashing is imagehash server-side.
+- Chat/messaging features are out of scope.