Add Gemini response: CurseForge upload automation consultation

docs/consultations/gemini-curseforge-upload-automation-2026-04-13.md

@@ -57,4 +57,79 @@ Thanks Gemini! Short one today but it'll unlock a lot if the answer is yes. 🔥
 
 ---
 
-*[Gemini's response will be added here after consultation]*
+## Gemini's Response (April 13, 2026)
+
+**Summary:** Yes, CurseForge has an upload API — but it requires a separate Author API Token (not the Core API key we already have). Different endpoint, different auth header. Files enter a review queue but can be held with `isMarkedForManualRelease`. Game version IDs are static integers — look them up once and hardcode them.
+
+---
+
+### 1. Two Different Keys
+
+The existing `$2a$10$` Core API key is **read-only** — ModpackChecker lookups only. File uploads require a separate **Author API Token** generated from CurseForge Account Settings → API Tokens.
+
+- **Upload endpoint:** `https://minecraft.curseforge.com/api/projects/1512533/upload-file`
+- **Auth header:** `X-Api-Token` (NOT `x-api-key`)
+
+### 2. Required Metadata
+
+`multipart/form-data` with two fields: `file` (the jar binary) and `metadata` (JSON string).
+
+Minimum required JSON fields:
+- `changelog` (string)
+- `changelogType` ("text", "html", or "markdown")
+- `releaseType` ("alpha", "beta", or "release")
+- `gameVersions` (array of integers — game version ID + mod loader ID)
+
+Game version IDs fetched via: `GET https://api.curseforge.com/v1/games/432/versions` using the existing Core API key. Since 1.21.1/1.20.1/1.16.5/NeoForge/Forge IDs are static, look them up once and hardcode them.
+
+### 3. Review Queue
+
+Files enter the standard review queue — not instant. Use `"isMarkedForManualRelease": true` in metadata to hold approved files until manual publish (useful for coordinating with Discord announcements).
+
+### 4. Minimal Upload Script (bash)
+
+```bash
+PROJECT_ID="1512533"
+CF_TOKEN="your_author_token_here"
+JAR_PATH="/path/to/discord-rules-1.21.1.jar"
+
+CF_METADATA=$(cat <<EOF
+{
+  "changelog": "Automated release via ffg-build.sh",
+  "changelogType": "text",
+  "displayName": "Discord Rules v1.0.5 (NeoForge 1.21.1)",
+  "releaseType": "release",
+  "gameVersions": [1234, 5678]
+}
+EOF
+)
+
+curl -X POST "https://minecraft.curseforge.com/api/projects/${PROJECT_ID}/upload-file" \
+  -H "X-Api-Token: ${CF_TOKEN}" \
+  -F "metadata=${CF_METADATA}" \
+  -F "file=@${JAR_PATH}"
+```
+
+### 5. Known Gotchas
+
+- **Omitting mod loader ID** from `gameVersions` — file uploads but won't appear in NeoForge/Forge filters
+- **Mixing up headers** — `X-Api-Token` for uploads, `x-api-key` for Core API reads — #1 cause of 403s
+- **Don't query IDs every build** — they're static, hardcode the mapping once
+
+---
+
+**Gemini's follow-up question:** Would you like the exact curl commands to fetch the integer IDs for 1.21.1, 1.20.1, 1.16.5, NeoForge, and Forge so Code can hardcode them into the script?
+
+---
+
+## Conclusion
+
+Upload API confirmed. Two blockers before Code can build this:
+1. Michael needs to generate an Author API Token from CurseForge Account Settings
+2. We need the integer IDs for our 5 game versions/loaders — Gemini offered to provide the curl commands to look them up
+
+**Next Steps:**
+1. Answer Gemini's follow-up — yes, get the ID lookup commands
+2. Michael generates Author API Token from CurseForge
+3. File Code bridge request for ffg-build.sh upload integration
+4. Store Author Token in Vaultwarden