Remove forum password grants table and refactor domain packages

.dependency-cruiser.cjs

@@ -1,30 +1,6 @@
-const DOMAIN = [
-  'accounts',
-  'antispam',
-  'groups',
-  'authorization',
-  'forums',
-  'threads',
-  'posts',
-  'profile-fields',
-  'messages',
-  'relations',
-  'reputation',
-  'signatures',
-  'admin',
-  'mail',
-  'markdown',
-  'moderation',
-  'notifications',
-  'settings',
-  'subscriptions',
-  'events',
-  'tasks',
-  'api',
-  'install',
-  'upgrade',
-  'import',
-].join('|')
+const { domainPackages } = require('./scripts/domain-packages.cjs')
+
+const DOMAIN = domainPackages().join('|')
 
 module.exports = {
   forbidden: [

.env.example

@@ -22,11 +22,11 @@
 # postgres = Drizzle + postgres.js against DATABASE_URL.
 DATA_SOURCE=fixture
 
-# For local development against a real database, `docker-compose.dev.yml` starts
+# For local development against a real database, `docker/compose.dev.yml` starts
 # one on port 55432 with a **named** volume, so the board survives the container
 # being recreated:
 #
-#   docker compose -f docker-compose.dev.yml up -d
+#   docker compose -f docker/compose.dev.yml up -d
 #   pnpm community migrate
 #
 #   DATA_SOURCE=postgres
@@ -36,7 +36,7 @@ DATA_SOURCE=fixture
 # !! READ THIS BEFORE SETTING DATABASE_URL !!
 # ─────────────────────────────────────────────────────────────────────────────
 # Your own Postgres, with a fixed number of processes in front of it, needs
-# nothing special. That is what docker-compose.yml gives you and what
+# nothing special. That is what docker/compose.yml gives you and what
 # docs/self-hosting.md walks through.
 #
 # Pointing at a MANAGED database instead? Use the TRANSACTION-MODE POOLER
@@ -76,7 +76,7 @@ AUTH_SECRET=
 # cron caller presents it as "Authorization: Bearer <TICK_SECRET>", or as an
 # "X-Tick-Secret" header. It is not read from the query string.
 TICK_SECRET=
-# Only read by docker-compose.yml, which interpolates it into the database's
+# Only read by docker/compose.yml, which interpolates it into the database's
 # own password. Hex rather than base64, deliberately: `/` or `+` in a password
 # breaks the postgres:// URL it is spliced into.
 # Generate with: openssl rand -hex 32

docs/architecture.md

@@ -111,10 +111,16 @@ The load-bearing rules, each a named `error` in
 The same config also enforces `no-circular` (import cycles are an error
 anywhere) and `no-deprecated-core`.
 
-`runtime`, `db`, `drivers` — and `demo`, whose seed and reset run SQL and
-migrations by nature — sit deliberately outside the protected domain list.
-The question that decides which side of the line a package is on: does this
-module *choose an implementation*?
+The domain list itself is derived, not maintained:
+[`scripts/domain-packages.cjs`](../scripts/domain-packages.cjs) reads
+`packages/` and subtracts the named infrastructure packages — `core`, `db`,
+`drivers`, `runtime`, `testkit`, `ui`, `plugin-kit`, `theme-kit`,
+`create-meith`, and `demo`, whose seed and reset run SQL and migrations by
+nature. Both dependency-cruiser and the textual guards
+(`scripts/guards.mjs`) read that one list, so a new domain package is under
+every rule from the moment its directory exists, rather than from the moment
+somebody remembers to add it to a list. The question that decides which side
+of the line a package is on: does this module *choose an implementation*?
 
 ### The floor: `@meith/core`
 

docs/disaster-recovery.md

@@ -85,7 +85,7 @@ comes up:
 
 ```sh
 docker compose up -d --no-start web
-docker run --rm -v meith_uploads:/u -v "$PWD":/backup alpine \
+docker run --rm -v docker_uploads:/u -v "$PWD":/backup alpine \
   tar xzf /backup/uploads-2026-08-20.tar.gz -C /u
 ```
 

docs/operating.md

@@ -193,7 +193,7 @@ Nothing in the database changes: it stores keys, not URLs.
    [rclone](https://rclone.org):
 
    ```sh
-   docker run --rm -v meith_uploads:/u:ro -v "$PWD/rclone.conf":/config/rclone/rclone.conf \
+   docker run --rm -v docker_uploads:/u:ro -v "$PWD/rclone.conf":/config/rclone/rclone.conf \
      rclone/rclone copy /u remote:your-bucket
    ```
 
@@ -2339,7 +2339,7 @@ container rather than on the host:
 
 ```sh
 docker compose exec -T postgres pg_dump -U community community | gzip > board-$(date +%F).sql.gz
-docker run --rm -v meith_uploads:/u -v "$PWD":/out alpine \
+docker run --rm -v docker_uploads:/u -v "$PWD":/out alpine \
   tar czf /out/uploads-$(date +%F).tar.gz -C /u .
 ```
 

packages/db/migrations/0050_drop_forum_password_grants.sql

@@ -0,0 +1 @@
+DROP TABLE "forum_password_grants" CASCADE;