Terminal-themed markdown diary

Single-user diary served as one Rust binary with the Svelte frontend
embedded.

- axum 0.8 + SQLite (sqlx), migrations run at startup
- stateless HMAC session cookie; credentials from .env, compared in
  constant time
- FTS5 full-text search, user input rewritten into quoted prefix terms
- media uploads linked to entries by scanning bodies for /api/media/<id>,
  which scopes share-token media access and entry deletion
- unguessable share links (192-bit token) serving a public read-only page
- vim keybindings via CodeMirror plus a modal browse layer and : command
  line; disabled on touch devices

.env.example

@@ -0,0 +1,22 @@
+# The one and only account. Both are checked in constant time on login.
+DIARY_USER=narl
+DIARY_PASSWORD=change-me
+
+# Signs session cookies. Rotate it to log every device out. 32+ random chars.
+# Generate one with: openssl rand -base64 32
+DIARY_SECRET=replace-with-32-random-characters
+
+# Where the SQLite database and uploaded media live.
+DIARY_DATA_DIR=./data
+
+# Address to listen on. Put a TLS terminating reverse proxy in front of this.
+DIARY_BIND=127.0.0.1:4242
+
+# How long a login lasts, in days.
+DIARY_SESSION_DAYS=30
+
+# Largest single upload, in megabytes.
+DIARY_MAX_UPLOAD_MB=64
+
+# Set to 1 once the app is served over HTTPS, so the cookie gets `Secure`.
+DIARY_SECURE_COOKIE=0