rust fmt, updated ci, hooks and docs

backend-rs/.env.example

@@ -1,44 +1,44 @@
-# Path to the SAME sqlite file Django uses (strangler: both backends share one DB).
-# Relative paths resolve from the process CWD; absolute is safest.
+# Path to the sqlite database. Relative paths resolve from the process CWD;
+# absolute is safest. Use mode=rw in prod so a wrong path fails loudly.
 DATABASE_URL=sqlite://../backend/db.sqlite3?mode=rwc
 
-# MUST equal Django's SECRET_KEY so SimpleJWT tokens verify across both backends.
-SECRET_KEY=change-me-to-match-django
+# Signs the SimpleJWT-compatible tokens. Keep this CONSTANT across deploys and
+# restarts — changing it invalidates every issued access/refresh token. (Use the
+# value the retired Django app used so tokens already in the wild stay valid.)
+SECRET_KEY=change-me
 
 # Where this service binds.
 BIND_ADDR=0.0.0.0:8001
 
-# Media URL prefix Django serves under (matches MEDIA_URL = "media/").
+# Media URL prefix (matches the historical Django MEDIA_URL = "media/").
 MEDIA_URL=media/
 
-# Filesystem root for uploaded media (avatars). Must point at the SAME directory
-# Django uses (MEDIA_ROOT) so both backends read/write the same files.
+# Filesystem root for uploaded media (avatars).
 MEDIA_ROOT=../backend/media
 
 # Base URL of the frontend, used to build email links (verify-email, reset).
-# Matches Django's FRONTEND_URL.
 FRONTEND_URL=http://localhost:5173
 
 # --- Email (lettre) -------------------------------------------------------
 # Leave EMAIL_HOST unset to log emails to the console (dev). Set it to enable
-# real SMTP. These mirror Django's EMAIL_* settings.
+# real SMTP.
 #EMAIL_HOST=smtp.example.com
 EMAIL_PORT=587
 EMAIL_USE_TLS=true
 EMAIL_USE_SSL=false
 #EMAIL_HOST_USER=noreply@example.com
 #EMAIL_HOST_PASSWORD=change-me
-# Accept self-signed SMTP certs (mirrors api.email_backend.InsecureEmailBackend).
+# Accept self-signed SMTP certs.
 EMAIL_SKIP_CERT_VERIFICATION=false
 # From address; falls back to EMAIL_HOST_USER then noreply@localhost.
 #DEFAULT_FROM_EMAIL=noreply@example.com
 
-# Set `Secure` on auth cookies (true in prod, like Django's JWT_AUTH_COOKIE_SECURE).
+# Set `Secure` on auth cookies (true in prod).
 JWT_AUTH_COOKIE_SECURE=false
 
-# In-process job scheduler (replaces Celery beat). MUST stay false while
-# Django's beat container is still running — otherwise scheduled jobs fire twice
-# against the shared api_job table. Set true ONLY after stopping Django beat.
+# In-process job scheduler (replaces Celery beat). Exactly one running instance
+# may set this true — it owns scheduling of the api_job table. Additional
+# instances must leave it false or jobs fire twice.
 ENABLE_SCHEDULER=false
 
 # tracing filter