Merge remote-tracking branch 'origin/release/3.0.0' into feature/5402-upgrade-md-operator-contract

# Conflicts:
#	CHANGELOG.md

Author: turegjorup

.dockerignore

@@ -26,6 +26,7 @@
 
 # CI / quality-tool configs (not consumed at runtime)
 /phpstan.dist.neon
+/phpstan-baseline.neon
 /phpunit.xml.dist
 /psalm.xml
 /psalm-baseline.xml
@@ -65,7 +66,7 @@ launch.json
 /test-results/
 /playwright-report/
 /blob-report/
-/playwright/.cache/
+/playwright/
 #< Playwright
 
 ###> vincentlanglet/twig-cs-fixer ###

.env

@@ -30,12 +30,17 @@ TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
 ###< symfony/framework-bundle ###
 
 ###> doctrine/doctrine-bundle ###
+# Doctrine `serverVersion` for dialect selection — must match the running
+# MariaDB. Default tracks the docker-compose default (mariadb:11.4);
+# override MARIADB_VERSION (and the matching MARIADB_IMAGE in compose) to
+# test against 10.11.
+MARIADB_VERSION=11.4.4-MariaDB
 # Database connection string for MariaDB/MySQL.
 # Format described at https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
 # IMPORTANT: You MUST configure your server version, either here or in config/packages/doctrine.yaml
 #
 # DATABASE_URL="sqlite:///%kernel.project_dir%/var/data.db"
-DATABASE_URL="mysql://db:db@mariadb:3306/db?serverVersion=10.11.5-MariaDB"
+DATABASE_URL="mysql://db:db@mariadb:3306/db?serverVersion=${MARIADB_VERSION}"
 #DATABASE_URL="postgresql://db_user:db_password@127.0.0.1:5432/db_name?serverVersion=13&charset=utf8"
 ###< doctrine/doctrine-bundle ###
 
@@ -72,6 +77,13 @@ JWT_SCREEN_REFRESH_TOKEN_TTL=2592000
 REDIS_CACHE_PREFIX=DisplayApiService
 # Connection string for Redis cache server.
 REDIS_CACHE_DSN=redis://redis:6379/0
+# Session storage backend, consumed by framework.session.handler_id.
+# A `redis://...` DSN makes Symfony auto-build a RedisSessionHandler (with
+# its own `sf_s` key prefix, so cache and session keys don't collide on
+# the same DB). Empty value = PHP's native file handler; pick that for
+# single-pod deployments that don't care about flock-induced tail latency
+# or container-restart session survival.
+SESSION_HANDLER_DSN=${REDIS_CACHE_DSN}
 ###< redis ###
 
 ###> Http Client ###
@@ -96,6 +108,9 @@ KEY_VAULT_JSON="{}"
 TRACK_SCREEN_INFO=false
 # Interval in seconds between screen info updates.
 TRACK_SCREEN_INFO_UPDATE_INTERVAL_SECONDS=300
+# Maximum media upload size in mebibytes (MiB). Read per-request, so no cache:clear needed.
+# Must stay aligned with NGINX_MAX_BODY_SIZE and php-fpm upload_max_filesize / post_max_size.
+MEDIA_MAX_UPLOAD_SIZE_MB=200
 # Toggle the relations checksum optimisation for content updates.
 RELATIONS_CHECKSUM_ENABLED=true
 ###< App ###
@@ -165,6 +180,11 @@ CALENDAR_API_FEED_SOURCE_CACHE_EXPIRE_SECONDS=300
 EVENTDATABASE_API_V2_CACHE_EXPIRE_SECONDS=300
 ###< Event Database Api V2 Feed Type ###
 
+###> Instant Book ###
+# Source of busy intervals data for instant booking interactive slides (graph or feed).
+INSTANT_BOOK_BUSY_INTERVALS_SOURCE=graph
+###< Instant Book ###
+
 ###> Admin configuration ###
 # API key for Rejseplanen (Danish journey planner) integration.
 ADMIN_REJSEPLANEN_APIKEY=
@@ -176,6 +196,10 @@ ADMIN_TOUCH_BUTTON_REGIONS=false
 ADMIN_LOGIN_METHODS='[{"type":"username-password","enabled":true,"provider":"username-password","label":""}]'
 # Enable enhanced preview mode with additional features.
 ADMIN_ENHANCED_PREVIEW=false
+# Optional HTML block shown in the login sidebar.
+# Allowed tags: strong, em, b, i, br, p, a, span. Allowed attrs: href, title, target, rel, class.
+# Leave empty to hide the sidebar text card entirely.
+ADMIN_LOGIN_SCREEN_TEXT=
 ###< Admin configuration ###
 
 ###> Client configuration ###
@@ -187,8 +211,8 @@ CLIENT_REFRESH_TOKEN_TIMEOUT=300000
 CLIENT_RELEASE_TIMESTAMP_INTERVAL_TIMEOUT=600000
 # Interval in milliseconds for running content scheduling checks. 60000 = 1 minute.
 CLIENT_SCHEDULING_INTERVAL=60000
-# Interval in milliseconds for pulling new content from server. 90000 = 1.5 minutes.
-CLIENT_PULL_STRATEGY_INTERVAL=90000
+# Interval in milliseconds for pulling new content from server. 600000 = 10 minutes.
+CLIENT_PULL_STRATEGY_INTERVAL=600000
 # JSON configuration for client color scheme with location coordinates.
 CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 # Enable debug mode for client-side logging and diagnostics.

.env.test

@@ -5,7 +5,7 @@ SYMFONY_DEPRECATIONS_HELPER=999999
 PANTHER_APP_ENV=panther
 PANTHER_ERROR_SCREENSHOT_DIR=./var/error-screenshots
 
-DATABASE_URL="mysql://root:password@mariadb:3306/db_test?serverVersion=mariadb-10.5.13"
+DATABASE_URL="mysql://root:password@mariadb:3306/db_test?serverVersion=${MARIADB_VERSION}"
 
 ###> lexik/jwt-authentication-bundle ###
 JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
@@ -19,3 +19,6 @@ JWT_SCREEN_TOKEN_TTL=43200
 JWT_REFRESH_TOKEN_TTL=3600
 JWT_SCREEN_REFRESH_TOKEN_TTL=86400
 ###< gesdinet/jwt-refresh-token-bundle ###
+
+# Lowered so testMediaUploadRejectedWhenTooLarge can build a small tmp file.
+MEDIA_MAX_UPLOAD_SIZE_MB=1

.git-blame-ignore-revs

@@ -0,0 +1,9 @@
+# Revisions to skip when running `git blame`.
+#
+# Configure once locally:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# Each line is a full commit SHA followed by a comment.
+
+# 7329: Applied coding standards (bulk style commit during psalm→phpstan migration)
+6a91050b2339fe7c1b5080f9cdb3219fe1adc739