Replace known development JWT secret placeholders with an ephemeral runtime secret during config loading.
Return LoadInfo so startup can warn when token persistence depends on a stable configured secret.
Update config docs and tests for default, legacy placeholder, custom, env, and empty secret behavior.
- Initialize slog in the serve command with terminal/file support
- Introduce `AppError` with HTTP status for unified service-layer errors
- Replace ad-hoc `api.Error` calls with `api.RespondError`
- Wrap internal errors with `model.NewInternalError` and add reference
IDs
- Add `RequestID` middleware and switch router from `gin.Default` to
`gin.New`
- Add GORM dependencies for SQLite and PostgreSQL
- Create domain models (User, Session, File) with common errors
- Implement repository interfaces and database layer with migrations
- Update WebApp to bootstrap with database and repositories
- Add comprehensive unit tests for repository methods
- Update config structure to support multiple database drivers
- Extend AGENTS.md with debugging principles and dependency rules
- The mapstructure library is no longer needed for direct duration
parsing since we now store TTLs as string durations (e.g., "15m",
"168h") and parse them on demand via helper methods.
- This allows more flexible duration formats in configuration and moves
the parsing responsibility to the JWT config struct itself.
ld