Merge main (Photos/People/Places + ReBAC) into the SvelteKit rewrite

Bring the feature-rich main branch into the frontend Svelte rewrite
(PR #478, base bcn/frontend-svelte-rewrite). main moved well ahead of the
PR's branch point (b8a0018): it added the Places photo-map and People
(faces) backends, photos enhancements, the ReBAC→role-grants migration,
load tests, and more.

Conflicts resolved (4 files):
- Dockerfile: combine the explicit --bin allowlist (defence-in-depth from
  main) with the SPA copy from the frontend build stage (PR).
- .github/workflows/ci.yml: keep the PR's Svelte frontend job
  (svelte-check + eslint + stylelint + prettier + vitest); the legacy
  static/-targeted tsc/locale/icon advisory steps don't fit the new
  working-directory: frontend job and svelte-check supersedes them.
- justfile: keep both the new fe-* / dev recipes (PR) and the load-* k6
  recipes (main).
- static/locales: keep the PR's symlink (-> ../frontend/static/locales);
  main's new photos/people locale keys are folded into the Svelte locale
  files alongside the ported views.

Backend (people/places/faces handlers, routes, DI, migrations) merged
cleanly. `cargo check --bins` passes. The new Places/People UI is not yet
in the Svelte app; that is ported in follow-up commits.

.github/workflows/ci.yml

@@ -168,7 +168,9 @@ jobs:
       - name: Fail if fixtures are stale (rebuild + commit them)
         run: git diff --exit-code tests/fixtures/plugins/
       - name: Run plugin runtime tests
-        run: cargo test --features plugins plugins::
+        # Quote: the trailing `::` confuses GitHub's YAML parser (mapping
+        # values not allowed) and aborts the whole workflow at load time.
+        run: 'cargo test --features plugins plugins::'
 
   rust-test:
     name: Server Unit and Functionnal Tests

.github/workflows/load-nightly.yml

@@ -0,0 +1,126 @@
+name: Load Nightly
+
+# Nightly regression gate. Runs every k6 scenario, diffs against
+# baseline/load.json, opens an issue if any metric regresses.
+#
+# IMPORTANT: shared GitHub-hosted runners produce noisy timings —
+# regression signal is unreliable until this workflow is moved to a
+# pinned self-hosted runner with consistent hardware. The cron run is
+# informational until then; treat opened issues as "investigate" not
+# "broken main."
+
+on:
+  schedule:
+    # 03:00 UTC daily — outside US/EU working hours, low contention.
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch / tag / SHA to load-test (leave blank to use the workflow ref). Lets you dispatch from main and run the scenarios against a feature branch — useful when the target branch does not have the workflow file yet.'
+        required: false
+        default: ''
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  load:
+    name: k6 load suite + baseline diff
+    # Skip the scheduled run on forks — nightly is only meaningful against the
+    # canonical baseline.json on the upstream repo. Forks can still hit it
+    # manually via `workflow_dispatch` if they want, and the guard is bypassed
+    # for that path (event != schedule). Additional fork repositories are
+    # opted-in explicitly below.
+    if: github.event_name != 'schedule' || github.repository == 'AtalayaLabs/OxiCloud' || github.repository == 'EdouardVanbelle/OxiCloud'
+    # tunning on Ed's nuc to ensure stable environment
+    # treating regressions here as merge-blocking. ubuntu-latest is too noisy
+    # for trustworthy p95/p99 deltas.
+    runs-on: [self-hosted, nuc-loadtest]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # `inputs.ref` is set only for workflow_dispatch with a non-empty
+          # value; for cron and bare dispatch it's empty, in which case the
+          # action falls back to the workflow's own ref (`github.ref`). The
+          # `||` short-circuits on empty strings, so the cron path keeps the
+          # exact behaviour it had before.
+          ref: ${{ inputs.ref || github.ref }}
+          # The self-hosted runner bind-mounts target/ as a persistent volume
+          # for fast incremental rebuilds. actions/checkout's default cleanup
+          # tries to rmdir it and hits EBUSY on the mount point. Git still
+          # syncs the working tree to the target SHA — only non-git files
+          # (target/, tests/load/results/) persist, which is what we want.
+          clean: false
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: load
+
+      - name: Install Node 20
+        # The self-hosted runner image ships Node 12, which can't parse the
+        # ES-module `.mjs` helpers (compare.mjs / merge-summaries.mjs /
+        # bake-baseline.mjs). Pin to a current LTS for both runners.
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install k6
+        uses: grafana/setup-k6-action@v1
+
+      - name: Build OxiCloud + load-seed (release)
+        # Single cargo invocation: load_seed_bin is an empty marker feature
+        # that gates the load-seed bin without changing oxicloud's dep
+        # graph, so cargo compiles oxicloud exactly once.
+        run: cargo build --release --features load_seed_bin --bin oxicloud --bin load-seed
+
+      - name: Run full load suite
+        id: load
+        run: bash tests/load/run.sh
+        env:
+          BUILD_TARGET: release
+        continue-on-error: true
+
+      - name: Upload raw k6 summaries
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: load-results-${{ github.run_id }}
+          path: tests/load/results/*.json
+          retention-days: 30
+
+      - name: Prepare regression report
+        if: steps.load.outcome == 'failure'
+        run: |
+          {
+            echo "## Load nightly regression"
+            echo ""
+            echo "Run: \`${{ github.run_id }}\`  ·  Commit: \`${{ github.sha }}\`"
+            echo "Ref tested: \`${{ inputs.ref || github.ref }}\`"
+            echo "Runner: \`${{ runner.name }}\` (\`${{ runner.os }}/${{ runner.arch }}\`)"
+            echo ""
+            echo "Compare exited non-zero — see uploaded artifact \`load-results-${{ github.run_id }}\` for raw summaries."
+            echo ""
+            echo "Baseline is anchored to the runner that produced it; cross-runner"
+            echo "comparisons (e.g. an artifact baked on different hardware) will"
+            echo "show large \"regressions\" that are really hardware deltas."
+          } > regression-issue.md
+
+      - name: Open issue on regression
+        # Skip on forks where Issues are disabled — the regression report is
+        # already in the artifact, and the workflow's exit code marks the run
+        # as failed regardless. Forks that want issue notifications can enable
+        # issues on their repo and remove this condition.
+        if: steps.load.outcome == 'failure' && github.repository == 'AtalayaLabs/OxiCloud'
+        uses: peter-evans/create-issue-from-file@v5
+        with:
+          # `github.sha` resolves to the workflow's ref, not the tested ref,
+          # so when dispatched against a non-default branch we surface the
+          # input explicitly — otherwise the title misleads with main's SHA.
+          title: "Load nightly: regression on ${{ inputs.ref || github.sha }}"
+          content-filepath: regression-issue.md
+          labels: |
+            load-test
+            regression

.github/workflows/load-smoke.yml

@@ -0,0 +1,45 @@
+name: Load Smoke
+
+# PR-tier liveness check. Verifies the k6 load harness still builds and a
+# single happy-path iteration runs against a freshly built server.
+# NO regression gate — that's the nightly workflow's job.
+
+on:
+  pull_request:
+    branches: [ main, dev ]
+    paths:
+      - 'tests/load/**'
+      - 'src/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'migrations/**'
+      - '.github/workflows/load-smoke.yml'
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  smoke:
+    name: k6 smoke (load harness)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: load
+
+      - name: Install k6
+        uses: grafana/setup-k6-action@v1
+
+      - name: Build OxiCloud (debug)
+        run: cargo build --bin oxicloud
+
+      - name: Run smoke scenario
+        run: bash tests/load/smoke.sh
+        env:
+          BUILD_TARGET: debug