Phase 3: J-IDs, ownership, roles, guest safety, adaptive detail, download

Backend:
- User.role (user/uploader/staff) with can_upload; uploads and downloads
  gated to uploader+; owners and staff can edit their items
- MediaItem.uploaded_by plus J-<id> identity (serializer, admin,
  scan_files --user, first superuser as default owner)
- API resolves J-<id>, bare numeric ids and MD5s; neighbors and lookup
  return j_ids
- Guest safety: mirror e621's anonymous default blacklist into Redis
  (parses comments, negations and wildcards), flag hidden_from_guests
  and filter lists, details and lookups for anonymous users
- POST /api/online/downloads/ writes an e621 file into the watched
  folder and indexes it for the uploader
- MariaDB + Redis via docker compose (host ports 3307/6380), PyMySQL
  driver shim, Redis cache replacing the file cache; SQLite data
  dumped and loaded into MariaDB

Frontend:
- Single /detail/:itemId route with an adaptive shell: J-<id> renders
  the library item, bare numbers render the e621 post
- Legacy /view/<md5> and /online/view/<id> redirect to canonical URLs
- Cards expose J-IDs; library custom-data editor is read-only for
  non-owners
- Role gating: Upload hidden/blocked for regular users, account shows
  the role, guest hint on the library

backend/config/__init__.py

@@ -0,0 +1,13 @@
+"""Django project package.
+
+Use PyMySQL as the MySQL/MariaDB driver. Django checks the driver library
+version, so report a compatible one before installing the shim (same trick
+the original J621 used).
+"""
+
+import pymysql
+
+pymysql.version_info = (2, 2, 1, "final", 0)
+pymysql.__version__ = "2.2.1"
+
+pymysql.install_as_MySQLdb()

backend/config/settings.py

@@ -85,12 +85,17 @@ TEMPLATES = [
 
 WSGI_APPLICATION = "config.wsgi.application"
 
-# Database
+# Database (MariaDB, run via docker compose at the repo root)
 
 DATABASES = {
     "default": {
-        "ENGINE": "django.db.backends.sqlite3",
-        "NAME": BASE_DIR / "db.sqlite3",
+        "ENGINE": "django.db.backends.mysql",
+        "NAME": os.getenv("DB_NAME", "j621"),
+        "USER": os.getenv("DB_USER", "j621"),
+        "PASSWORD": os.getenv("DB_PASSWORD", "j621"),
+        "HOST": os.getenv("DB_HOST", "127.0.0.1"),
+        "PORT": os.getenv("DB_PORT", "3307"),
+        "OPTIONS": {"charset": "utf8mb4"},
     }
 }
 
@@ -135,6 +140,32 @@ if not WATCHED_FOLDER.is_absolute():
     WATCHED_FOLDER = BASE_DIR / WATCHED_FOLDER
 WATCHED_FOLDER = str(WATCHED_FOLDER)
 
+# e621 integration
+
+E621_BASE_URL = os.getenv("E621_BASE_URL", "https://e621.net").rstrip("/")
+USER_AGENT = os.getenv("USER_AGENT", "J621/0.1 (by J621 on e621)")
+
+# Guest visibility: e621's anonymous default blacklist is mirrored into the
+# cache by `manage.py refresh_guest_blacklist`. This fallback is used until
+# that command runs or when e621 is unreachable.
+GUEST_BLACKLIST_FALLBACK = [
+    tag.strip()
+    for tag in os.getenv(
+        "GUEST_BLACKLIST_FALLBACK", "young,cub,shota,loli,child,underage"
+    ).split(",")
+    if tag.strip()
+]
+GUEST_BLACKLIST_TTL = int(os.getenv("GUEST_BLACKLIST_TTL", "3600"))
+
+# Redis cache (run via docker compose at the repo root), shared by web
+# workers and management commands (e.g. the mirrored guest blacklist).
+CACHES = {
+    "default": {
+        "BACKEND": "django.core.cache.backends.redis.RedisCache",
+        "LOCATION": os.getenv("REDIS_URL", "redis://127.0.0.1:6380/1"),
+    }
+}
+
 # Django REST Framework
 
 REST_FRAMEWORK = {