refactor: form-core wiring, JWT sessions, slowapi, packaging, frontend rewrite, test declutter

This commit is contained in:
Jonas Miederer 2026-09-28 18:03:07 +02:00
parent 06ab25fb47
commit 03af41e837
74 changed files with 6089 additions and 5183 deletions

View file

@ -36,6 +36,9 @@ CALLBACK_BASE_URL=http://api:8000
# Shared secret for flow callbacks (POST /api/approvals carries it as
# X-Callback-Token). Long random value; empty disables callbacks.
CALLBACK_TOKEN=
# Secret signing stateless session JWTs (HS256). Long random value
# (openssl rand -hex 32); empty fails closed at login time.
JWT_SECRET=
# --- frontend mode: unset/preview serves the production bundle ---
# Dev sets FRONTEND_MODE=dev (HMR); .devcontainer/setup.sh provisions it.