fix: run pocketbase as root + add healthcheck start_period

- Remove non-root user from pocketbase Docker image; the existing pb_data volume was created by the previous root-running image so files are owned by root — running as a non-root appuser caused an immediate permission error and container exit - Increase healthcheck retries to 10 and add start_period=30s so migrations have time to run on first boot before liveness checks begin Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: pocketbase healthcheck (add wget) + saveIfAbsent infinite recursion
2026-04-15 19:00:21 +05:00 · 2026-04-15 18:05:02 +05:00 · 2026-04-15 11:06:27 +05:00 · 2026-04-14 19:38:26 +05:00 · 2026-04-14 19:30:42 +05:00
10 changed files with 772 additions and 42 deletions
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -41,6 +41,9 @@ jobs:
      - name: Build healthcheck
        run: go build -o /dev/null ./cmd/healthcheck

+      - name: Build pocketbase
+        run: go build -o /dev/null ./cmd/pocketbase
+
      - name: Run tests
        run: go test -short -race -count=1 -timeout=60s ./...

--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -276,6 +276,69 @@ jobs:
          cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-caddy:latest
          cache-to: type=inline

+      # ── pocketbase ───────────────────────────────────────────────────────────
+      - name: Docker meta / pocketbase
+        id: meta-pocketbase
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ secrets.DOCKER_USER }}/libnovel-pocketbase
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest
+
+      - name: Build and push / pocketbase
+        uses: docker/build-push-action@v6
+        with:
+          context: backend
+          target: pocketbase
+          push: true
+          tags: ${{ steps.meta-pocketbase.outputs.tags }}
+          labels: ${{ steps.meta-pocketbase.outputs.labels }}
+          cache-from: type=registry,ref=${{ secrets.DOCKER_USER }}/libnovel-pocketbase:latest
+          cache-to: type=inline
+
+  # ── deploy: sync docker-compose.yml + restart prod ───────────────────────────
+  # Runs after all images are pushed to Docker Hub.
+  # Copies the compose file from the tagged commit to the server, pulls the new
+  # images, and restarts only the services whose image or config changed.
+  # --remove-orphans cleans up containers no longer defined in the compose file
+  # (e.g. the now-removed pb-init container).
+  #
+  # Required Gitea secrets:
+  #   PROD_HOST             — prod server IP or hostname
+  #   PROD_USER             — SSH login user (typically root)
+  #   PROD_SSH_KEY          — private key whose public half is in authorized_keys
+  #   PROD_SSH_KNOWN_HOSTS  — output of: ssh-keyscan -H <PROD_HOST>
+  deploy:
+    name: Deploy to prod
+    runs-on: ubuntu-latest
+    needs: [docker]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install SSH key
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          printf '%s\n' "${{ secrets.PROD_SSH_KNOWN_HOSTS }}" >> ~/.ssh/known_hosts
+
+      - name: Copy docker-compose.yml to prod
+        run: |
+          scp -i ~/.ssh/deploy_key \
+            docker-compose.yml \
+            "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}:/opt/libnovel/docker-compose.yml"
+
+      - name: Pull new images and restart changed services
+        run: |
+          ssh -i ~/.ssh/deploy_key \
+            "${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }}" \
+            'set -euo pipefail
+             cd /opt/libnovel
+             doppler run -- docker compose pull
+             doppler run -- docker compose up -d --remove-orphans'
+
  # ── Gitea release ─────────────────────────────────────────────────────────────
  release:
    name: Gitea Release
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -27,7 +27,10 @@ RUN --mount=type=cache,target=/root/go/pkg/mod \
      -o /out/runner ./cmd/runner && \
    CGO_ENABLED=0 GOOS=linux go build \
      -ldflags="-s -w" \
-      -o /out/healthcheck ./cmd/healthcheck
+      -o /out/healthcheck ./cmd/healthcheck && \
+    CGO_ENABLED=0 GOOS=linux go build \
+      -ldflags="-s -w" \
+      -o /out/pocketbase ./cmd/pocketbase

 # ── backend service ──────────────────────────────────────────────────────────
 # Uses Alpine (not distroless) so ffmpeg is available for on-demand voice
@@ -40,6 +43,18 @@ COPY --from=builder /out/backend /backend
 USER appuser
 ENTRYPOINT ["/backend"]

+# ── pocketbase service ───────────────────────────────────────────────────────
+# Runs the custom PocketBase binary with Go migrations baked in.
+# On every `serve` startup it applies any pending migrations automatically.
+# Data is stored in /pb_data (mounted as a Docker volume in production).
+FROM alpine:3.21 AS pocketbase
+RUN apk add --no-cache ca-certificates wget
+COPY --from=builder /out/pocketbase /pocketbase
+RUN mkdir -p /pb_data
+VOLUME /pb_data
+EXPOSE 8090
+CMD ["/pocketbase", "serve", "--dir", "/pb_data", "--http", "0.0.0.0:8090"]
+
 # ── runner service ───────────────────────────────────────────────────────────
 # Uses Alpine (not distroless) so ffmpeg is available for WAV→MP3 transcoding
 # when pocket-tts voices are used.
--- a/backend/cmd/pocketbase/main.go
+++ b/backend/cmd/pocketbase/main.go
@@ -0,0 +1,47 @@
+// Command pocketbase is a thin wrapper that runs PocketBase as a Go framework
+// with version-controlled Go migrations.
+//
+// On every `serve`, PocketBase automatically applies any pending migrations from
+// the migrations/ package before accepting traffic.
+//
+// Usage (Docker):
+//
+//	./pocketbase serve --dir /pb_data --http 0.0.0.0:8090
+//
+// Migration workflow:
+//
+//	# Generate a timestamped stub:
+//	go run ./cmd/pocketbase migrate create "description"
+//	# Apply manually (also runs automatically on serve):
+//	go run ./cmd/pocketbase migrate up
+//	# Revert last migration:
+//	go run ./cmd/pocketbase migrate down 1
+//	# After migrating an existing install, mark existing schema as done:
+//	go run ./cmd/pocketbase migrate history-sync
+package main
+
+import (
+	"log"
+
+	"github.com/pocketbase/pocketbase"
+	"github.com/pocketbase/pocketbase/plugins/migratecmd"
+
+	// Register all migrations via init().
+	_ "github.com/libnovel/backend/migrations"
+)
+
+func main() {
+	app := pocketbase.New()
+
+	// Register the migrate sub-command.
+	// Automigrate: false — migrations are written by hand, never auto-generated
+	// from Admin UI changes. Pending migrations still apply automatically on
+	// every `serve` regardless of this flag.
+	migratecmd.MustRegister(app, app.RootCmd, migratecmd.Config{
+		Automigrate: false,
+	})
+
+	if err := app.Start(); err != nil {
+		log.Fatal(err)
+	}
+}
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -3,12 +3,14 @@ module github.com/libnovel/backend
 go 1.26.1

 require (
+	github.com/SherClockHolmes/webpush-go v1.4.0
 	github.com/getsentry/sentry-go v0.43.0
 	github.com/hibiken/asynq v0.26.0
 	github.com/hibiken/asynq/x v0.0.0-20260203063626-d704b68a426d
 	github.com/meilisearch/meilisearch-go v0.36.1
 	github.com/minio/minio-go/v7 v7.0.98
 	github.com/pdfcpu/pdfcpu v0.11.1
+	github.com/pocketbase/pocketbase v0.36.9
 	github.com/prometheus/client_golang v1.23.2
 	github.com/redis/go-redis/v9 v9.18.0
 	github.com/yuin/goldmark v1.8.2
@@ -20,43 +22,57 @@ require (
 	go.opentelemetry.io/otel/log v0.18.0
 	go.opentelemetry.io/otel/sdk v1.42.0
 	go.opentelemetry.io/otel/sdk/log v0.18.0
-	golang.org/x/net v0.51.0
+	golang.org/x/net v0.52.0
 )

 require (
-	github.com/SherClockHolmes/webpush-go v1.4.0 // indirect
 	github.com/andybalholm/brotli v1.1.1 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/disintegration/imaging v1.6.2 // indirect
+	github.com/domodwyer/mailyak/v3 v3.6.2 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
+	github.com/ganigeorgiev/fexpr v0.5.0 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
 	github.com/hhrutter/lzw v1.0.0 // indirect
 	github.com/hhrutter/pkcs7 v0.2.0 // indirect
 	github.com/hhrutter/tiff v1.0.2 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.21 // indirect
 	github.com/mattn/go-runewidth v0.0.19 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pocketbase/dbx v1.12.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/tinylib/msgp v1.6.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect
@@ -66,14 +82,20 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/image v0.32.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/crypto v0.49.0 // indirect
+	golang.org/x/image v0.38.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/text v0.36.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
 	google.golang.org/grpc v1.79.2 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
+	modernc.org/libc v1.70.0 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+	modernc.org/sqlite v1.48.2 // indirect
 )
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -2,6 +2,9 @@ github.com/SherClockHolmes/webpush-go v1.4.0 h1:ocnzNKWN23T9nvHi6IfyrQjkIc0oJWv1
 github.com/SherClockHolmes/webpush-go v1.4.0/go.mod h1:XSq8pKX11vNV8MJEMwjrlTkxhAj1zKfxmyhdV7Pd6UA=
 github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7XdTA=
 github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA=
+github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
@@ -14,16 +17,28 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY=
 github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
+github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
+github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
+github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
+github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/ganigeorgiev/fexpr v0.5.0 h1:XA9JxtTE/Xm+g/JFI6RfZEHSiQlk+1glLvRK1Lpv/Tk=
+github.com/ganigeorgiev/fexpr v0.5.0/go.mod h1:RyGiGqmeXhEQ6+mlGdnUleLHgtzzu/VGO2WtJkF5drE=
 github.com/getsentry/sentry-go v0.43.0 h1:XbXLpFicpo8HmBDaInk7dum18G9KSLcjZiyUKS+hLW4=
 github.com/getsentry/sentry-go v0.43.0/go.mod h1:XDotiNZbgf5U8bPDUAfvcFmOnMQQceESxyKaObSssW0=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
@@ -35,18 +50,27 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0 h1:byhDUpfEwjsVQb1vBunvIjh2BHQ9ead57VkAEY4V+Es=
+github.com/go-ozzo/ozzo-validation/v4 v4.3.0/go.mod h1:2NKgrcHl3z6cJs+3Oo940FPRiTzuqKbvfrL2RxCj6Ew=
+github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
+github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hhrutter/lzw v1.0.0 h1:laL89Llp86W3rRs83LvKbwYRx6INE8gDn0XNb1oXtm0=
 github.com/hhrutter/lzw v1.0.0/go.mod h1:2HC6DJSn/n6iAZfgM3Pg+cP1KxeWc3ezG8bBqW5+WEo=
 github.com/hhrutter/pkcs7 v0.2.0 h1:i4HN2XMbGQpZRnKBLsUwO3dSckzgX142TNqY/KfXg+I=
@@ -57,6 +81,8 @@ github.com/hibiken/asynq v0.26.0 h1:1Zxr92MlDnb1Zt/QR5g2vSCqUS03i95lUfqx5X7/wrw=
 github.com/hibiken/asynq v0.26.0/go.mod h1:Qk4e57bTnWDoyJ67VkchuV6VzSM9IQW2nPvAGuDyw58=
 github.com/hibiken/asynq/x v0.0.0-20260203063626-d704b68a426d h1:Ld5m8EIK5QVOq/owOexKIbETij3skACg4eU1pArHsrw=
 github.com/hibiken/asynq/x v0.0.0-20260203063626-d704b68a426d/go.mod h1:hhpStehaxSGg3ib9wJXzw5AXY1YS6lQ9BNavAgPbIhE=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
 github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
@@ -70,6 +96,10 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.21 h1:xYae+lCNBP7QuW4PUnNG61ffM4hVIfm+zUzDuSzYLGs=
+github.com/mattn/go-isatty v0.0.21/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4=
 github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw=
 github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
 github.com/meilisearch/meilisearch-go v0.36.1 h1:mJTCJE5g7tRvaqKco6DfqOuJEjX+rRltDEnkEC02Y0M=
@@ -82,6 +112,8 @@ github.com/minio/minio-go/v7 v7.0.98 h1:MeAVKjLVz+XJ28zFcuYyImNSAh8Mq725uNW4beRi
 github.com/minio/minio-go/v7 v7.0.98/go.mod h1:cY0Y+W7yozf0mdIclrttzo1Iiu7mEf9y7nk2uXqMOvM=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/pdfcpu/pdfcpu v0.11.1 h1:htHBSkGH5jMKWC6e0sihBFbcKZ8vG1M67c8/dJxhjas=
 github.com/pdfcpu/pdfcpu v0.11.1/go.mod h1:pP3aGga7pRvwFWAm9WwFvo+V68DfANi9kxSQYioNYcw=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
@@ -92,6 +124,10 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
+github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
+github.com/pocketbase/pocketbase v0.36.9 h1:x3mXMB4AwhTzJ34JZpZR7IQyUih7Fx1l86r0V/k4oW8=
+github.com/pocketbase/pocketbase v0.36.9/go.mod h1:t3sMcAxGHrDAXNcZ+65cZxBMpFP1vBdI9DrghB4n5Gw=
 github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
@@ -102,14 +138,24 @@ github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzM
 github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is=
 github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
 github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
@@ -165,15 +211,19 @@ golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliY
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/image v0.32.0 h1:6lZQWq75h7L5IWNk0r+SCpUJ6tUVd3v4ZHnbRKLkUDQ=
-golang.org/x/image v0.32.0/go.mod h1:/R37rrQmKXtO6tYXAjtDLwQgFLHmhW+V6ayXlxzP2Pc=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
+golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
+golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -182,8 +232,10 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
-golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
+golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
+golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -191,6 +243,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -202,8 +256,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -214,6 +268,7 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
@@ -222,8 +277,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
+golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -232,9 +287,13 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
+golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/appengine v1.6.5 h1:tycE03LOZYQNhDpS27tcQdAzLCVMaj7QT2SXxebnpCM=
+google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0=
 google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac=
@@ -246,7 +305,36 @@ google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
+modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
+modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
+modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
+modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
+modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
+modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
+modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
+modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.48.2 h1:5CnW4uP8joZtA0LedVqLbZV5GD7F/0x91AXeSyjoh5c=
+modernc.org/sqlite v1.48.2/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
--- a/backend/migrations/20260414000001_initial_schema.go
+++ b/backend/migrations/20260414000001_initial_schema.go
@@ -0,0 +1,431 @@
+// Migration 1 — full schema baseline.
+//
+// Creates all 21 collections that were previously bootstrapped by
+// scripts/pb-init-v3.sh.  Also creates the initial superuser from the
+// POCKETBASE_ADMIN_EMAIL / POCKETBASE_ADMIN_PASSWORD env vars (first run only).
+//
+// This migration is intentionally idempotent: each collection is skipped if it
+// already exists.  This makes it safe to apply on an existing install without
+// running `migrate history-sync` first — existing collections are left untouched
+// and migration 2 still runs to add the three fields that were missing.
+package migrations
+
+import (
+	"os"
+
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		steps := []func(core.App) error{
+			createBooks,
+			createChaptersIdx,
+			createRanking,
+			createProgress,
+			createScrapingTasks,
+			createAudioJobs,
+			createAppUsers,
+			createUserSessions,
+			createUserLibrary,
+			createUserSettings,
+			createUserSubscriptions,
+			createBookComments,
+			createCommentVotes,
+			createTranslationJobs,
+			createImportTasks,
+			createNotifications,
+			createPushSubscriptions,
+			createAIJobs,
+			createDiscoveryVotes,
+			createBookRatings,
+			createSiteConfig,
+			createInitialSuperuser,
+		}
+		for _, step := range steps {
+			if err := step(app); err != nil {
+				return err
+			}
+		}
+		return nil
+	}, func(app core.App) error {
+		// Down: drop all collections in safe reverse order.
+		names := []string{
+			"site_config", "book_ratings", "discovery_votes", "ai_jobs",
+			"push_subscriptions", "notifications", "import_tasks",
+			"translation_jobs", "comment_votes", "book_comments",
+			"user_subscriptions", "user_settings", "user_library",
+			"user_sessions", "app_users", "audio_jobs", "scraping_tasks",
+			"progress", "ranking", "chapters_idx", "books",
+		}
+		for _, name := range names {
+			coll, err := app.FindCollectionByNameOrId(name)
+			if err != nil {
+				continue // already absent — safe to skip
+			}
+			if err := app.Delete(coll); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+// saveIfAbsent saves the collection only when no collection with that name
+// exists yet.  This makes the migration safe to run on an existing install
+// without history-sync — already-created collections are simply skipped.
+func saveIfAbsent(app core.App, c *core.Collection) error {
+	if _, err := app.FindCollectionByNameOrId(c.Name); err == nil {
+		return nil // already exists — skip
+	}
+	return app.Save(c)
+}
+
+// ── Collection creators ───────────────────────────────────────────────────────
+
+func createBooks(app core.App) error {
+	c := core.NewBaseCollection("books")
+	c.Fields.Add(
+		&core.TextField{Name: "slug", Required: true},
+		&core.TextField{Name: "title", Required: true},
+		&core.TextField{Name: "author"},
+		&core.TextField{Name: "cover"},
+		&core.TextField{Name: "status"},
+		&core.JSONField{Name: "genres"},
+		&core.TextField{Name: "summary"},
+		&core.NumberField{Name: "total_chapters"},
+		&core.TextField{Name: "source_url"},
+		&core.NumberField{Name: "ranking"},
+		&core.TextField{Name: "meta_updated"},
+		&core.BoolField{Name: "archived"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createChaptersIdx(app core.App) error {
+	c := core.NewBaseCollection("chapters_idx")
+	c.Fields.Add(
+		&core.TextField{Name: "slug", Required: true},
+		&core.NumberField{Name: "number", Required: true},
+		&core.TextField{Name: "title"},
+	)
+	// Enforce uniqueness on (slug, number) — prevents duplicate chapter entries.
+	c.AddIndex("idx_chapters_idx_slug_number", true, "slug, number", "")
+	// Allow fast "recently updated books" queries.
+	c.AddIndex("idx_chapters_idx_created", false, "created", "")
+	return saveIfAbsent(app, c)
+}
+
+func createRanking(app core.App) error {
+	c := core.NewBaseCollection("ranking")
+	c.Fields.Add(
+		&core.NumberField{Name: "rank", Required: true},
+		&core.TextField{Name: "slug", Required: true},
+		&core.TextField{Name: "title"},
+		&core.TextField{Name: "author"},
+		&core.TextField{Name: "cover"},
+		&core.TextField{Name: "status"},
+		&core.JSONField{Name: "genres"},
+		&core.TextField{Name: "source_url"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createProgress(app core.App) error {
+	c := core.NewBaseCollection("progress")
+	c.Fields.Add(
+		&core.TextField{Name: "session_id", Required: true},
+		&core.TextField{Name: "slug", Required: true},
+		&core.NumberField{Name: "chapter"},
+		&core.TextField{Name: "user_id"},
+		&core.NumberField{Name: "audio_time"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createScrapingTasks(app core.App) error {
+	c := core.NewBaseCollection("scraping_tasks")
+	c.Fields.Add(
+		&core.TextField{Name: "kind"},
+		&core.TextField{Name: "target_url"},
+		&core.NumberField{Name: "from_chapter"},
+		&core.NumberField{Name: "to_chapter"},
+		&core.TextField{Name: "worker_id"},
+		&core.TextField{Name: "status", Required: true},
+		&core.NumberField{Name: "books_found"},
+		&core.NumberField{Name: "chapters_scraped"},
+		&core.NumberField{Name: "chapters_skipped"},
+		&core.NumberField{Name: "errors"},
+		&core.TextField{Name: "error_message"},
+		&core.DateField{Name: "started"},
+		&core.DateField{Name: "finished"},
+		&core.DateField{Name: "heartbeat_at"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createAudioJobs(app core.App) error {
+	c := core.NewBaseCollection("audio_jobs")
+	c.Fields.Add(
+		&core.TextField{Name: "cache_key", Required: true},
+		&core.TextField{Name: "slug", Required: true},
+		&core.NumberField{Name: "chapter", Required: true},
+		&core.TextField{Name: "voice"},
+		&core.TextField{Name: "worker_id"},
+		&core.TextField{Name: "status", Required: true},
+		&core.TextField{Name: "error_message"},
+		&core.DateField{Name: "started"},
+		&core.DateField{Name: "finished"},
+		&core.DateField{Name: "heartbeat_at"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createAppUsers(app core.App) error {
+	c := core.NewBaseCollection("app_users")
+	c.Fields.Add(
+		&core.TextField{Name: "username", Required: true},
+		&core.TextField{Name: "password_hash"},
+		&core.TextField{Name: "role"},
+		&core.TextField{Name: "avatar_url"},
+		&core.TextField{Name: "email"},
+		&core.BoolField{Name: "email_verified"},
+		&core.TextField{Name: "verification_token"},
+		&core.TextField{Name: "verification_token_exp"},
+		&core.TextField{Name: "oauth_provider"},
+		&core.TextField{Name: "oauth_id"},
+		&core.TextField{Name: "polar_customer_id"},
+		&core.TextField{Name: "polar_subscription_id"},
+		&core.BoolField{Name: "notify_new_chapters"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createUserSessions(app core.App) error {
+	c := core.NewBaseCollection("user_sessions")
+	c.Fields.Add(
+		&core.TextField{Name: "user_id", Required: true},
+		&core.TextField{Name: "session_id", Required: true},
+		&core.TextField{Name: "user_agent"},
+		&core.TextField{Name: "ip"},
+		&core.TextField{Name: "device_fingerprint"},
+		// created_at is a custom text field (not the system `created` date field).
+		&core.TextField{Name: "created_at"},
+		&core.TextField{Name: "last_seen"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createUserLibrary(app core.App) error {
+	c := core.NewBaseCollection("user_library")
+	c.Fields.Add(
+		&core.TextField{Name: "session_id", Required: true},
+		&core.TextField{Name: "user_id"},
+		&core.TextField{Name: "slug", Required: true},
+		&core.TextField{Name: "saved_at"},
+		&core.TextField{Name: "shelf"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createUserSettings(app core.App) error {
+	c := core.NewBaseCollection("user_settings")
+	c.Fields.Add(
+		&core.TextField{Name: "session_id", Required: true},
+		&core.TextField{Name: "user_id"},
+		&core.BoolField{Name: "auto_next"},
+		&core.TextField{Name: "voice"},
+		&core.NumberField{Name: "speed"},
+		&core.TextField{Name: "theme"},
+		&core.TextField{Name: "locale"},
+		&core.TextField{Name: "font_family"},
+		&core.NumberField{Name: "font_size"},
+		&core.BoolField{Name: "announce_chapter"},
+		&core.TextField{Name: "audio_mode"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createUserSubscriptions(app core.App) error {
+	c := core.NewBaseCollection("user_subscriptions")
+	c.Fields.Add(
+		&core.TextField{Name: "follower_id", Required: true},
+		&core.TextField{Name: "followee_id", Required: true},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createBookComments(app core.App) error {
+	c := core.NewBaseCollection("book_comments")
+	c.Fields.Add(
+		&core.TextField{Name: "slug", Required: true},
+		&core.TextField{Name: "user_id"},
+		&core.TextField{Name: "username"},
+		&core.TextField{Name: "body"},
+		&core.NumberField{Name: "upvotes"},
+		&core.NumberField{Name: "downvotes"},
+		&core.TextField{Name: "parent_id"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createCommentVotes(app core.App) error {
+	c := core.NewBaseCollection("comment_votes")
+	c.Fields.Add(
+		&core.TextField{Name: "comment_id", Required: true},
+		&core.TextField{Name: "user_id"},
+		&core.TextField{Name: "session_id"},
+		&core.TextField{Name: "vote"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createTranslationJobs(app core.App) error {
+	c := core.NewBaseCollection("translation_jobs")
+	c.Fields.Add(
+		&core.TextField{Name: "cache_key", Required: true},
+		&core.TextField{Name: "slug", Required: true},
+		&core.NumberField{Name: "chapter", Required: true},
+		&core.TextField{Name: "lang", Required: true},
+		&core.TextField{Name: "worker_id"},
+		&core.TextField{Name: "status", Required: true},
+		&core.TextField{Name: "error_message"},
+		&core.DateField{Name: "started"},
+		&core.DateField{Name: "finished"},
+		&core.DateField{Name: "heartbeat_at"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createImportTasks(app core.App) error {
+	c := core.NewBaseCollection("import_tasks")
+	c.Fields.Add(
+		&core.TextField{Name: "slug", Required: true},
+		&core.TextField{Name: "title", Required: true},
+		&core.TextField{Name: "file_name"},
+		&core.TextField{Name: "file_type"},
+		&core.TextField{Name: "object_key"},
+		&core.TextField{Name: "chapters_key"},
+		&core.TextField{Name: "author"},
+		&core.TextField{Name: "cover_url"},
+		&core.TextField{Name: "genres"},
+		&core.TextField{Name: "summary"},
+		&core.TextField{Name: "book_status"},
+		&core.TextField{Name: "worker_id"},
+		&core.TextField{Name: "initiator_user_id"},
+		&core.TextField{Name: "status", Required: true},
+		&core.NumberField{Name: "chapters_done"},
+		&core.NumberField{Name: "chapters_total"},
+		&core.TextField{Name: "error_message"},
+		&core.DateField{Name: "started"},
+		&core.DateField{Name: "finished"},
+		&core.DateField{Name: "heartbeat_at"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createNotifications(app core.App) error {
+	c := core.NewBaseCollection("notifications")
+	c.Fields.Add(
+		&core.TextField{Name: "user_id", Required: true},
+		&core.TextField{Name: "title", Required: true},
+		&core.TextField{Name: "message"},
+		&core.TextField{Name: "link"},
+		&core.BoolField{Name: "read"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createPushSubscriptions(app core.App) error {
+	c := core.NewBaseCollection("push_subscriptions")
+	c.Fields.Add(
+		&core.TextField{Name: "user_id", Required: true},
+		&core.TextField{Name: "endpoint", Required: true},
+		&core.TextField{Name: "p256dh", Required: true},
+		&core.TextField{Name: "auth", Required: true},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createAIJobs(app core.App) error {
+	c := core.NewBaseCollection("ai_jobs")
+	c.Fields.Add(
+		&core.TextField{Name: "kind", Required: true},
+		&core.TextField{Name: "slug"},
+		&core.TextField{Name: "status", Required: true},
+		&core.NumberField{Name: "from_item"},
+		&core.NumberField{Name: "to_item"},
+		&core.NumberField{Name: "items_done"},
+		&core.NumberField{Name: "items_total"},
+		&core.TextField{Name: "model"},
+		&core.TextField{Name: "payload"},
+		&core.TextField{Name: "error_message"},
+		&core.DateField{Name: "started"},
+		&core.DateField{Name: "finished"},
+		&core.DateField{Name: "heartbeat_at"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createDiscoveryVotes(app core.App) error {
+	c := core.NewBaseCollection("discovery_votes")
+	c.Fields.Add(
+		&core.TextField{Name: "session_id", Required: true},
+		&core.TextField{Name: "user_id"},
+		&core.TextField{Name: "slug", Required: true},
+		&core.TextField{Name: "action", Required: true},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createBookRatings(app core.App) error {
+	c := core.NewBaseCollection("book_ratings")
+	c.Fields.Add(
+		&core.TextField{Name: "session_id", Required: true},
+		&core.TextField{Name: "user_id"},
+		&core.TextField{Name: "slug", Required: true},
+		&core.NumberField{Name: "rating", Required: true},
+	)
+	return saveIfAbsent(app, c)
+}
+
+func createSiteConfig(app core.App) error {
+	c := core.NewBaseCollection("site_config")
+	c.Fields.Add(
+		&core.TextField{Name: "decoration"},
+		&core.TextField{Name: "logoAnimation"},
+		&core.TextField{Name: "eventLabel"},
+	)
+	return saveIfAbsent(app, c)
+}
+
+// createInitialSuperuser creates the first PocketBase superuser from env vars.
+// It is a no-op if a superuser with that email already exists, or if the env
+// vars are not set.  This replaces the superuser bootstrap block in
+// scripts/pb-init-v3.sh.
+func createInitialSuperuser(app core.App) error {
+	email := os.Getenv("POCKETBASE_ADMIN_EMAIL")
+	password := os.Getenv("POCKETBASE_ADMIN_PASSWORD")
+	if email == "" || password == "" {
+		return nil
+	}
+
+	existing, _ := app.FindFirstRecordByData("_superusers", "email", email)
+	if existing != nil {
+		return nil // superuser already exists
+	}
+
+	superusers, err := app.FindCollectionByNameOrId("_superusers")
+	if err != nil {
+		return err
+	}
+
+	record := core.NewRecord(superusers)
+	record.Set("email", email)
+	record.Set("password", password)
+	record.Set("passwordConfirm", password)
+	return app.Save(record)
+}
--- a/backend/migrations/20260414000002_missing_fields.go
+++ b/backend/migrations/20260414000002_missing_fields.go
@@ -0,0 +1,71 @@
+// Migration 2 — add fields present in code but absent from pb-init-v3.sh.
+//
+// Discovered by auditing every PocketBase field access in the Go backend
+// and SvelteKit UI against the collection definitions in pb-init-v3.sh:
+//
+//   books.rating              (number) — written by WriteMetadata but never defined.
+//   app_users.notify_new_chapters_push (bool) — used in UI push-notification opt-in.
+//   book_comments.chapter     (number) — used to scope comments to a chapter (0 = book-level).
+//
+// The check for field existence makes this migration safe to re-apply on
+// a fresh install where migration 1 already created the collections without
+// these fields.
+package migrations
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		type addition struct {
+			collection string
+			field      core.Field
+		}
+		additions := []addition{
+			{"books", &core.NumberField{Name: "rating"}},
+			{"app_users", &core.BoolField{Name: "notify_new_chapters_push"}},
+			{"book_comments", &core.NumberField{Name: "chapter"}},
+		}
+		for _, a := range additions {
+			coll, err := app.FindCollectionByNameOrId(a.collection)
+			if err != nil {
+				return err
+			}
+			if coll.Fields.GetByName(a.field.GetName()) != nil {
+				continue // already present — idempotent
+			}
+			coll.Fields.Add(a.field)
+			if err := app.Save(coll); err != nil {
+				return err
+			}
+		}
+		return nil
+	}, func(app core.App) error {
+		type removal struct {
+			collection string
+			field      string
+		}
+		removals := []removal{
+			{"books", "rating"},
+			{"app_users", "notify_new_chapters_push"},
+			{"book_comments", "chapter"},
+		}
+		for _, r := range removals {
+			coll, err := app.FindCollectionByNameOrId(r.collection)
+			if err != nil {
+				continue
+			}
+			f := coll.Fields.GetByName(r.field)
+			if f == nil {
+				continue
+			}
+			coll.Fields.RemoveById(f.GetId())
+			if err := app.Save(coll); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -67,12 +67,21 @@ services:
      MINIO_ROOT_PASSWORD: "${MINIO_ROOT_PASSWORD}"

  # ─── PocketBase (auth + structured data) ─────────────────────────────────────
+  # Custom binary built from backend/cmd/pocketbase — runs Go migrations on every
+  # startup before accepting traffic, replacing the old pb-init-v3.sh script.
  pocketbase:
-    image: ghcr.io/muchobien/pocketbase:latest
+    image: kalekber/libnovel-pocketbase:${GIT_TAG:-latest}
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+      target: pocketbase
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"
    restart: unless-stopped
    environment:
-      PB_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
-      PB_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
+      # Used by migration 1 to create the initial superuser on a fresh install.
+      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
+      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
    # No public port — accessed only by backend/runner on the internal network.
    expose:
      - "8090"
@@ -82,21 +91,8 @@ services:
      test: ["CMD", "wget", "-qO-", "http://localhost:8090/api/health"]
      interval: 10s
      timeout: 5s
-      retries: 5
-
-  # ─── PocketBase collection bootstrap ─────────────────────────────────────────
-  pb-init:
-    image: alpine:3.19
-    depends_on:
-      pocketbase:
-        condition: service_healthy
-    environment:
-      POCKETBASE_URL: "http://pocketbase:8090"
-      POCKETBASE_ADMIN_EMAIL: "${POCKETBASE_ADMIN_EMAIL}"
-      POCKETBASE_ADMIN_PASSWORD: "${POCKETBASE_ADMIN_PASSWORD}"
-    volumes:
-      - ./scripts/pb-init-v3.sh:/pb-init.sh:ro
-    entrypoint: ["sh", "/pb-init.sh"]
+      retries: 10
+      start_period: 30s

  # ─── Meilisearch (full-text search) ──────────────────────────────────────────
  meilisearch:
@@ -166,8 +162,6 @@ services:
    restart: unless-stopped
    stop_grace_period: 35s
    depends_on:
-      pb-init:
-        condition: service_completed_successfully
      pocketbase:
        condition: service_healthy
      minio:
@@ -221,8 +215,6 @@ services:
    restart: unless-stopped
    stop_grace_period: 135s
    depends_on:
-      pb-init:
-        condition: service_completed_successfully
      pocketbase:
        condition: service_healthy
      minio:
@@ -276,8 +268,6 @@ services:
    restart: unless-stopped
    stop_grace_period: 35s
    depends_on:
-      pb-init:
-        condition: service_completed_successfully
      backend:
        condition: service_healthy
      pocketbase:
--- a/2
+++ b/2
@@ -56,7 +56,7 @@ build-svc svc:

 # Push all custom images to Docker Hub (requires docker login)
 push:
-    {{doppler}} docker compose push backend runner ui caddy
+    {{doppler}} docker compose push backend runner ui caddy pocketbase

 # Build then push all custom images
 build-push: build push
Author	SHA1	Message	Date
Admin	fc73756308	fix: run pocketbase as root + add healthcheck start_period Some checks failed Release / Test backend (push) Successful in 56s Details Release / Check ui (push) Successful in 1m59s Details Release / Docker (push) Successful in 7m49s Details Release / Deploy to prod (push) Failing after 33s Details Release / Gitea Release (push) Successful in 29s Details - Remove non-root user from pocketbase Docker image; the existing pb_data volume was created by the previous root-running image so files are owned by root — running as a non-root appuser caused an immediate permission error and container exit - Increase healthcheck retries to 10 and add start_period=30s so migrations have time to run on first boot before liveness checks begin Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-15 19:00:21 +05:00
Admin	3f436877ee	fix: pocketbase healthcheck (add wget) + saveIfAbsent infinite recursion Some checks failed Release / Test backend (push) Successful in 1m6s Details Release / Check ui (push) Successful in 1m56s Details Release / Docker (push) Successful in 8m19s Details Release / Deploy to prod (push) Failing after 36s Details Release / Gitea Release (push) Successful in 22s Details - Add wget to pocketbase Alpine image so the docker-compose healthcheck (wget http://localhost:8090/api/health) can actually run - Fix saveIfAbsent calling itself instead of app.Save(c) — was an infinite recursion that would stack-overflow on a fresh install Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-15 18:05:02 +05:00
Admin	812028e50d	ci: add pocketbase image build + automated prod deploy step Some checks failed Release / Test backend (push) Successful in 5m39s Details Release / Check ui (push) Successful in 2m1s Details Release / Docker (push) Successful in 7m46s Details Release / Deploy to prod (push) Failing after 1m53s Details Release / Gitea Release (push) Successful in 35s Details release.yaml: - Build and push kalekber/libnovel-pocketbase image on every release tag - Add deploy job (runs after docker): copies docker-compose.yml from the tagged commit to /opt/libnovel on prod, pulls new images, restarts changed services with --remove-orphans (cleans up removed pb-init) ci.yaml: - Validate cmd/pocketbase builds on every branch push Required new Gitea secrets: PROD_HOST, PROD_USER, PROD_SSH_KEY, PROD_SSH_KNOWN_HOSTS (see deploy job comments for instructions). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-15 11:06:27 +05:00
Admin	38cf1c82a1	fix: make migration 1 idempotent for existing installs Each collection creator now skips creation if the collection already exists, so deploying to an existing prod install no longer requires running `migrate history-sync` manually. Migration 2 (missing fields) still applies as normal since those fields genuinely don't exist yet. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-14 19:38:26 +05:00
Admin	fd0f2afe16	feat: replace pb-init-v3.sh with PocketBase Go migrations Adds a custom PocketBase binary (cmd/pocketbase) that embeds PocketBase as a Go framework with version-controlled migrations, replacing the fragile 419-line shell script. Migrations apply automatically on every `serve` startup. Migration 1 (20260414000001): full baseline schema — all 21 collections, both indexes on chapters_idx, and initial superuser creation from env vars. Migration 2 (20260414000002): adds three fields found in code but missing from the old script — books.rating, app_users.notify_new_chapters_push, book_comments.chapter. docker-compose: pocketbase service now uses the custom kalekber/libnovel-pocketbase image; pb-init one-shot container removed (migrations replace it entirely). Existing installs: run `migrate history-sync` once to mark migration 1 as done, then restart — migration 2 will apply the three previously missing fields. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-14 19:30:42 +05:00