feat: expand backend admin marketplace and scaling

SCALING_SETUP.md

@@ -0,0 +1,85 @@
+# Scaling Setup
+
+This codebase now supports optional Redis, BullMQ, S3-compatible storage, structured JSON logging, and feed caching.
+
+## What was added
+
+- Redis-backed cache and rate limiting fallback to in-memory
+- Optional Socket.IO Redis adapter
+- Optional BullMQ queue for outbox processing
+- Pluggable storage layer with:
+  - `local`
+  - `s3` compatible providers such as AWS S3 or Cloudflare R2
+- Feed response caching with versioned invalidation
+- Fast refresh-token fingerprinting to reduce bcrypt load
+- JSON request logging
+
+## Feature flags
+
+### Redis
+
+```env
+REDIS_ENABLED=true
+REDIS_URL=redis://127.0.0.1:6379
+REDIS_KEY_PREFIX=oudelaa
+REDIS_SOCKET_ADAPTER_ENABLED=true
+```
+
+### Queue
+
+```env
+QUEUE_ENABLED=true
+QUEUE_NAME=app-jobs
+QUEUE_DEFAULT_ATTEMPTS=3
+QUEUE_DEFAULT_BACKOFF_MS=1000
+QUEUE_WORKER_CONCURRENCY=5
+```
+
+Queue processing falls back to in-process execution when Redis/queue is disabled.
+
+### S3 / R2
+
+```env
+STORAGE_PROVIDER=s3
+STORAGE_BASE_PATH=uploads
+STORAGE_PUBLIC_BASE_URL=https://cdn.example.com
+S3_BUCKET=oudelaa
+S3_REGION=auto
+S3_ENDPOINT=https://<account-or-endpoint>
+S3_ACCESS_KEY_ID=...
+S3_SECRET_ACCESS_KEY=...
+S3_FORCE_PATH_STYLE=false
+```
+
+For Cloudflare R2, `S3_REGION=auto` is acceptable and `STORAGE_PUBLIC_BASE_URL` should usually point to the CDN/custom domain.
+
+### Logging
+
+```env
+LOG_LEVEL=log
+REQUEST_LOGGING_ENABLED=true
+```
+
+### Feed cache
+
+```env
+FEED_CACHE_ENABLED=true
+FEED_CACHE_USER_TTL_SECONDS=15
+FEED_CACHE_TRENDING_TTL_SECONDS=30
+```
+
+## Practical rollout order
+
+1. Enable JSON logging in staging
+2. Enable Redis cache and Redis rate limiting
+3. Enable BullMQ queue for outbox jobs
+4. Move uploads to S3/R2
+5. Enable Socket.IO Redis adapter when running multiple instances
+6. Run authenticated load tests against `auth`, `feed`, `posts`, `chat`, and `notifications`
+
+## Current limitations
+
+- The app is still a modular monolith, not separate microservices yet
+- Feed caching is versioned invalidation plus TTL, not full fan-out precomputation
+- Marketplace images are still URL-based data, not binary upload pipelines
+- Local tests do not replace full production benchmarking