chore: initial project scaffold

Set up Mangalord with a Rust/axum backend, SvelteKit frontend, Postgres,
and Docker Compose deployment. Establishes the architecture and TDD
patterns the project will extend:

- Hexagonal-ish backend layering (domain / repo / storage / api) with
  a pluggable Storage trait (LocalStorage today, S3 as a future impl).
- Initial migration: users, mangas, chapters, bookmarks.
- Vertical slice for mangas (list, search, create, get) with
  #[sqlx::test] integration coverage and storage unit tests.
- SvelteKit frontend using Svelte 5 runes, typed API client, Vitest
  unit tests and Playwright e2e with route mocking.
- CLAUDE.md documenting layering, TDD/git/SemVer workflow rules, and
  extension points (tags, fulltext search, OCR, S3, auth).
- Project-scoped .claude/settings.json with permission allowlist for
  the toolchain (git, cargo, npm/vite, docker, psql, gh, doc fetches).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/storage/local.rs

@@ -0,0 +1,97 @@
+use std::path::{Path, PathBuf};
+
+use async_trait::async_trait;
+use tokio::fs;
+
+use super::{Storage, StorageError};
+
+pub struct LocalStorage {
+    root: PathBuf,
+}
+
+impl LocalStorage {
+    pub fn new(root: impl Into<PathBuf>) -> Self {
+        Self { root: root.into() }
+    }
+
+    fn resolve(&self, key: &str) -> Result<PathBuf, StorageError> {
+        let key = key.trim_start_matches('/');
+        if key.is_empty() {
+            return Err(StorageError::BadKey);
+        }
+        if key.split('/').any(|seg| seg.is_empty() || seg == "." || seg == "..") {
+            return Err(StorageError::BadKey);
+        }
+        Ok(self.root.join(key))
+    }
+}
+
+#[async_trait]
+impl Storage for LocalStorage {
+    async fn put(&self, key: &str, bytes: &[u8]) -> Result<(), StorageError> {
+        let path = self.resolve(key)?;
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).await?;
+        }
+        fs::write(path, bytes).await?;
+        Ok(())
+    }
+
+    async fn get(&self, key: &str) -> Result<Vec<u8>, StorageError> {
+        let path = self.resolve(key)?;
+        match fs::read(&path).await {
+            Ok(b) => Ok(b),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Err(StorageError::NotFound),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    async fn delete(&self, key: &str) -> Result<(), StorageError> {
+        let path = self.resolve(key)?;
+        match fs::remove_file(&path).await {
+            Ok(()) => Ok(()),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Err(StorageError::NotFound),
+            Err(e) => Err(e.into()),
+        }
+    }
+
+    async fn exists(&self, key: &str) -> Result<bool, StorageError> {
+        let path: &Path = &self.resolve(key)?;
+        Ok(fs::try_exists(path).await?)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    #[tokio::test]
+    async fn put_get_delete_roundtrip() {
+        let dir = tempdir().unwrap();
+        let s = LocalStorage::new(dir.path());
+
+        s.put("mangas/abc/cover.jpg", b"hello").await.unwrap();
+        assert!(s.exists("mangas/abc/cover.jpg").await.unwrap());
+        assert_eq!(s.get("mangas/abc/cover.jpg").await.unwrap(), b"hello");
+        s.delete("mangas/abc/cover.jpg").await.unwrap();
+        assert!(!s.exists("mangas/abc/cover.jpg").await.unwrap());
+    }
+
+    #[tokio::test]
+    async fn rejects_path_traversal() {
+        let dir = tempdir().unwrap();
+        let s = LocalStorage::new(dir.path());
+        assert!(matches!(s.put("../escape", b"x").await, Err(StorageError::BadKey)));
+        assert!(matches!(s.get("a/../../b").await, Err(StorageError::BadKey)));
+        assert!(matches!(s.exists("").await, Err(StorageError::BadKey)));
+    }
+
+    #[tokio::test]
+    async fn missing_key_is_not_found() {
+        let dir = tempdir().unwrap();
+        let s = LocalStorage::new(dir.path());
+        assert!(matches!(s.get("nope").await, Err(StorageError::NotFound)));
+        assert!(matches!(s.delete("nope").await, Err(StorageError::NotFound)));
+    }
+}

backend/src/storage/mod.rs

@@ -0,0 +1,31 @@
+//! Pluggable blob storage.
+//!
+//! Handlers depend on the `Storage` trait, never on a concrete backend.
+//! Add new backends (S3, GCS, …) as new impls in this module and wire
+//! them up in `app::build` based on config.
+
+mod local;
+
+use std::io;
+
+use async_trait::async_trait;
+
+pub use local::LocalStorage;
+
+#[derive(thiserror::Error, Debug)]
+pub enum StorageError {
+    #[error(transparent)]
+    Io(#[from] io::Error),
+    #[error("not found")]
+    NotFound,
+    #[error("invalid storage key")]
+    BadKey,
+}
+
+#[async_trait]
+pub trait Storage: Send + Sync {
+    async fn put(&self, key: &str, bytes: &[u8]) -> Result<(), StorageError>;
+    async fn get(&self, key: &str) -> Result<Vec<u8>, StorageError>;
+    async fn delete(&self, key: &str) -> Result<(), StorageError>;
+    async fn exists(&self, key: &str) -> Result<bool, StorageError>;
+}