Upgrade configuration and Docker stack to v2.0.0

app/config.py

@@ -4,14 +4,14 @@ Configuration centralisée — chargée depuis .env
 from pathlib import Path
 from typing import List
 from pydantic_settings import BaseSettings
-from pydantic import field_validator
+from pydantic import field_validator, model_validator
 import json
 
 
 class Settings(BaseSettings):
     # Application
     APP_NAME: str = "Imago"
-    APP_VERSION: str = "1.0.0"
+    APP_VERSION: str = "2.0.0"
     API_V1_SUNSET_DATE: str = ""
     DEBUG: bool = False
     SECRET_KEY: str = "changez-moi"
@@ -44,9 +44,13 @@ class Settings(BaseSettings):
     # AI — Comportement
     AI_TAGS_MIN: int = 5
     AI_TAGS_MAX: int = 10
-    AI_DESCRIPTION_LANGUAGE: str = "français"
+    AI_DESCRIPTION_LANGUAGE: str = "fran\u00e7ais"
     AI_CACHE_DAYS: int = 30
 
+    # AI — Résilience
+    AI_REQUEST_TIMEOUT: int = 60
+    AI_MAX_RETRIES: int = 2
+
     # OCR
     OCR_ENABLED: bool = True
     TESSERACT_CMD: str = "/usr/bin/tesseract"
@@ -59,6 +63,7 @@ class Settings(BaseSettings):
     ADMIN_API_KEY: str = ""
     JWT_SECRET_KEY: str = "changez-moi-jwt-secret"
     JWT_ALGORITHM: str = "HS256"
+    API_KEY_HASH_ROUNDS: int = 12
 
     # Rate limiting — global (legacy)
     RATE_LIMIT_UPLOAD: int = 10
@@ -72,24 +77,25 @@ class Settings(BaseSettings):
     RATE_LIMIT_PREMIUM_UPLOAD: int = 500
     RATE_LIMIT_PREMIUM_AI: int = 1000
 
-    # Redis + ARQ Worker
-    REDIS_URL: str = "redis://localhost:6379"
-    WORKER_MAX_JOBS: int = 10
-    WORKER_JOB_TIMEOUT: int = 180
-    WORKER_MAX_TRIES: int = 3
-    AI_STEP_TIMEOUT: int = 120
-    OCR_STEP_TIMEOUT: int = 30
+    # Rate limiting — stockage Redis (optionnel, mémoire par défaut)
+    RATE_LIMIT_STORAGE_URL: str = ""
 
-    # Storage Backend
-    STORAGE_BACKEND: str = "local"          # "local" | "s3"
-    S3_BUCKET: str = ""
+    # Redis + ARQ Worker
+    REDIS_URL: str = "redis://localhost:6379/0"
+    PIPELINE_TIMEOUT: int = 300  # secondes — timeout max d'un job pipeline
+    PIPELINE_MAX_RETRIES: int = 3  # tentatives avant Dead Letter Queue
+    REDIS_POOL_MAX_CONNECTIONS: int = 20
+
+    # Storage backends
+    STORAGE_BACKEND: str = "local"
+    S3_BUCKET: str = "imago"
+    S3_PREFIX: str = ""
     S3_REGION: str = "us-east-1"
-    S3_ENDPOINT_URL: str = ""               # vide = AWS, sinon MinIO/R2
-    S3_ENDPOINT_PUBLIC: str = ""            # URL utilisée pour les liens présignés (ex: http://localhost:9000)
+    S3_ENDPOINT_URL: str = ""
     S3_ACCESS_KEY: str = ""
     S3_SECRET_KEY: str = ""
-    S3_PREFIX: str = "imago"
-    SIGNED_URL_SECRET: str = "changez-moi-signed-url"
+    S3_ENDPOINT_PUBLIC: str = ""
+    SIGNED_URL_SECRET: str = "changez-moi-signed-url-secret"
 
     @field_validator("CORS_ORIGINS", mode="before")
     @classmethod
@@ -101,6 +107,16 @@ class Settings(BaseSettings):
                 return [v]
         return v
 
+    @model_validator(mode="after")
+    def validate_cors_credentials(self):
+        """Empêche allow_credentials=True avec origins=['*']."""
+        if self.CORS_ORIGINS == ["*"] or "*" in self.CORS_ORIGINS:
+            raise ValueError(
+                "CORS_ORIGINS ne peut pas contenir '*' quand "
+                "allow_credentials=True. Spécifiez les origines explicitement."
+            )
+        return self
+
     @property
     def upload_path(self) -> Path:
         p = Path(self.UPLOAD_DIR)