[rene-roid]

Summary

• One config file. sakuya.config.json at the repo root is read by the server, its launcher and the Vite dev server. It is created with the defaults on first run, and gitignored. sakuya.config.example.json is the committed reference with every setting, and a test keeps it identical to what a first run writes. A JSON schema gives editors autocomplete and a description of each setting on hover.
• Fixes the old .env setup. The root .env was never loaded by the server, because Bun reads .env from the working directory and the server runs from apps/server. As a result, resource limits set there did nothing, and changing the port broke Vite's hardcoded proxy.
• Migration. The first run seeds the new file from any old .env / apps/server/.env / environment, so the port, data dir and login carry over. An old AUTH_ENABLED=true that the file doesn't agree with refuses to start rather than come up without a password.
• Env vars only override inside Docker (SAKUYA_*). The image pins host, port and data dir. Outside Docker they are ignored, and the boot log says so.
• Resource limits are now limits.cpus and limits.memory, enforced as a hard ceiling by a launcher that wraps only the server:
  • Linux: a systemd scope, with each property probed separately.
  • Windows: a job object.
  • Docker: the app detects the container's CPU quota instead of it being restated.
  • The boot log reports what is actually enforced.
• Compose. docker-compose.yml is generic; machine-specific mounts, ports and limits go in a gitignored docker-compose.override.yml.

Breaking changes

• Environment variables and .env files are ignored outside Docker (they are migrated once on first run).
• Removed SAKUYA_JOB_CONCURRENCY, SAKUYA_FFMPEG_THREADS, SAKUYA_ONNX_THREADS, SAKUYA_SHARP_CONCURRENCY and SAKUYA_HARD_LIMIT; limits.cpus derives all of them.
• In Docker, PORT / AUTH_ENABLED / AUTH_SECRET are now SAKUYA_PORT / SAKUYA_AUTH_ENABLED / SAKUYA_AUTH_SECRET, and sakuya.config.json must exist before docker compose up.

Test plan

• bun test --isolate: 107 pass. Includes new config-loader tests and the Windows job-object struct layout.
• bun run typecheck, bun run lint (no new warnings)
• bun dev on Linux with limits set: the server runs in a systemd scope with memory.max = 512 MiB and cpu.max = 1 CPU, Vite stays outside it, and /api proxies through the configured ports
• Docker: both images build. The container reads the mounted file, pinned values win, a SAKUYA_AUTH_ENABLED override turns login on (401), and --cpus / --memory are detected
• Migration from an existing apps/server/.env keeps login enabled with the same password
• Windows: job-object limits have not been run on Windows yet