feat(server): load .env via dotenvy on startup

The binary now reads a .env file itself (dotenvy::dotenv() at the top of main),
so 'cargo run -p server' / the release binary pick up config without relying on
just's 'set dotenv-load'. Missing .env is a no-op.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Cargo.lock

@@ -2077,6 +2077,7 @@ dependencies = [
  "clap",
  "db",
  "domain",
+ "dotenvy",
  "http-body-util",
  "memory-serve",
  "reqwest",

Cargo.toml

@@ -28,4 +28,5 @@ argon2 = "0.5"
 tower-sessions = "0.14"
 tower-sessions-sqlx-store = { version = "0.15", features = ["postgres"] }
 rpassword = "7"
+dotenvy = "0.15"
 memory-serve = "2.1"

crates/server/Cargo.toml

@@ -27,6 +27,7 @@ db = { path = "../db" }
 domain = { path = "../domain" }
 search = { path = "../search" }
 rpassword.workspace = true
+dotenvy.workspace = true
 memory-serve = { workspace = true, optional = true }
 
 [build-dependencies]

crates/server/src/main.rs

@@ -41,6 +41,10 @@ impl From<RoleArg> for Role {
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
+    // Load a .env file (if present) so the binary picks up config when run directly,
+    // not only via `just` (which uses `set dotenv-load`). A missing .env is fine.
+    dotenvy::dotenv().ok();
+
     tracing_subscriber::fmt()
         .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
         .init();

justfile

@@ -4,6 +4,12 @@ set dotenv-load
 run:
     cargo run -p server
 
+# Build the web SPA + run the server in release mode with the SPA embedded (served at /)
+run-release:
+    # build.rs embeds web/dist, so the frontend must be built first
+    cd web && pnpm build
+    cargo run -p server --release --features embed-web
+
 # Seed the baseline Spectrum cataloguing vocabularies + field definitions (idempotent)
 seed:
     cargo run -p server -- seed