Integrate Oudelaa backend features, security, tests, and deployment updates

.env.example

@@ -6,16 +6,44 @@ HOST=0.0.0.0
 PUBLIC_BASE_URL=http://localhost:4000
 PUBLIC_APP_URL=https://oudelaa.com
 RESPONSE_ENVELOPE_ENABLED=false
+SWAGGER_ENABLED=true
 GLOBAL_PREFIX=api/v1
 # Add every frontend origin used by web/mobile debug tools.
 CORS_ORIGINS=http://localhost:3000,http://192.168.1.14:3000,http://192.168.1.14:5173
 MONGODB_URI=mongodb://127.0.0.1:27017/oudelaa
+MONGODB_AUTO_INDEX=true
+MONGODB_MIN_POOL_SIZE=5
+MONGODB_MAX_POOL_SIZE=100
+MONGODB_MAX_IDLE_TIME_MS=60000
+MONGODB_SERVER_SELECTION_TIMEOUT_MS=10000
+MONGODB_SOCKET_TIMEOUT_MS=45000
+# Search keeps the same API contract. "auto" uses Atlas Search when available
+# and falls back to MongoDB regex search on local/community deployments.
+SEARCH_ENGINE=auto
+SEARCH_ATLAS_USER_INDEX=users_search
+SEARCH_ATLAS_POST_INDEX=posts_search
+SEARCH_FALLBACK_ENABLED=true
+SEARCH_ATLAS_RETRY_SECONDS=300
 JWT_ACCESS_SECRET=change_me_access_secret
 JWT_ACCESS_EXPIRES_IN=15m
 JWT_REFRESH_SECRET=change_me_refresh_secret
 JWT_REFRESH_EXPIRES_IN=30d
 BCRYPT_SALT_ROUNDS=12
 REFRESH_TOKEN_HASH_SECRET=
+HTTP_BODY_LIMIT=1mb
+# Controller execution deadline. Override individual long-running routes with @RequestTimeout().
+HTTP_REQUEST_TIMEOUT_MS=30000
+# Low-level slow-client protection and connection reuse limits.
+HTTP_SERVER_REQUEST_TIMEOUT_MS=120000
+HTTP_HEADERS_TIMEOUT_MS=15000
+HTTP_KEEP_ALIVE_TIMEOUT_MS=5000
+HTTP_MAX_REQUESTS_PER_SOCKET=1000
+# Time allowed for in-flight controller requests after SIGTERM/SIGINT.
+SHUTDOWN_GRACE_PERIOD_MS=30000
+METRICS_EVENT_LOOP_RESOLUTION_MS=20
+METRICS_EVENT_LOOP_LAG_WARN_MS=100
+METRICS_MAX_ROUTES=500
+MODERATION_BLOCKED_TERMS=
 PASSWORD_RESET_CODE_EXPIRES_MINUTES=10
 PASSWORD_RESET_MAX_ATTEMPTS=5
 PASSWORD_RESET_TOKEN_SECRET=
@@ -31,6 +59,10 @@ REQUEST_LOGGING_ENABLED=true
 FEED_CACHE_ENABLED=true
 FEED_CACHE_USER_TTL_SECONDS=15
 FEED_CACHE_TRENDING_TTL_SECONDS=30
+FEED_CACHE_RANKING_PROFILE_TTL_SECONDS=30
+FEED_TIMING_LOGS_ENABLED=false
+HTTP_COMPRESSION_ENABLED=true
+HTTP_COMPRESSION_THRESHOLD_BYTES=1024
 
 REDIS_ENABLED=false
 REDIS_URL=
@@ -50,6 +82,7 @@ QUEUE_REMOVE_ON_COMPLETE=true
 QUEUE_WORKER_CONCURRENCY=5
 
 STORAGE_PROVIDER=local
+MEDIA_ACCESS_MODE=direct
 STORAGE_BASE_PATH=uploads
 # In Docker/production with local storage, mount a persistent volume to /app/uploads
 # or to the runtime path resolved from STORAGE_BASE_PATH.
@@ -113,7 +146,10 @@ AI_MUSIC_MODEL=lyria-002
 
 SUPERADMIN_EMAIL=admin@oudelaa.com
 SUPERADMIN_PASSWORD=SuperAdminStrongPass123!
+# Required in production. Generate with bcrypt and leave SUPERADMIN_PASSWORD empty there.
+SUPERADMIN_PASSWORD_HASH=
 SUPERADMIN_ACCESS_SECRET=change_me_superadmin_access_secret
 SUPERADMIN_ACCESS_EXPIRES_IN=15m
 SUPERADMIN_REFRESH_SECRET=change_me_superadmin_refresh_secret
 SUPERADMIN_REFRESH_EXPIRES_IN=30d
+SUPERADMIN_TOTP_SECRET=