Refactor Dockerfile and documentation for non-root user setup. Update CLAUDE.md and README.md to clarify media storage permissions and user requirements. Modify appsettings for local development database configuration. Enhance MediaEndpoints by removing unused regex and improving file resolution logic. Update BumperPreview to use SHA-256 for asset ID generation, ensuring better security practices.

backend/src/TeleWave.Api/Endpoints/MediaEndpoints.cs

@@ -1,5 +1,4 @@
 using System.Text;
-using System.Text.RegularExpressions;
 using LiteCqrs;
 using Microsoft.Extensions.Options;
 using TeleWave.Api.Common;
@@ -19,8 +18,6 @@ namespace TeleWave.Api.Endpoints;
 
 public static class MediaEndpoints
 {
-    private static readonly Regex SegmentFileName = new(@"^seg\d{1,6}\.ts$", RegexOptions.Compiled);
-
     public static IEndpointRouteBuilder MapMediaEndpoints(this IEndpointRouteBuilder app)
     {
         var admin = app.MapGroup("/api/admin/media")
@@ -177,16 +174,7 @@ public static class MediaEndpoints
     /// <summary>Плейлист ассета: переписываем ffmpeg-index.m3u8, направляя сегменты на admin-роут.</summary>
     private static IResult PreviewPlaylist(Guid id, MediaPathResolver paths)
     {
-        string indexPath;
-        try
-        {
-            indexPath = paths.SegmentPath(id, "index.m3u8");
-        }
-        catch (UnauthorizedAccessException)
-        {
-            return Results.NotFound();
-        }
-        if (!File.Exists(indexPath))
+        if (SegmentFiles.TryResolveExisting(paths, id, "index.m3u8") is not { } indexPath)
             return Results.NotFound();
 
         var baseUrl = $"/api/admin/media/{id}/preview/";
@@ -206,19 +194,10 @@ public static class MediaEndpoints
 
     private static IResult PreviewSegment(Guid id, string file, MediaPathResolver paths)
     {
-        if (!SegmentFileName.IsMatch(file))
+        if (!SegmentFiles.IsSegmentName(file))
             return Results.NotFound();
 
-        string path;
-        try
-        {
-            path = paths.SegmentPath(id, file);
-        }
-        catch (UnauthorizedAccessException)
-        {
-            return Results.NotFound();
-        }
-        if (!File.Exists(path))
+        if (SegmentFiles.TryResolveExisting(paths, id, file) is not { } path)
             return Results.NotFound();
 
         return Results.File(path, "video/mp2t", enableRangeProcessing: true);

backend/src/TeleWave.Api/appsettings.Development.json

@@ -1,4 +1,10 @@
 {
+  // Локальная БД разработчика. В appsettings.json строки подключения нет намеренно: этот файл
+  // едет в образ, и креды в нём (даже заведомо игрушечные) — это и находка сканера, и приглашение
+  // однажды поправить их «на месте» вместо ConnectionStrings__Default из окружения.
+  "ConnectionStrings": {
+    "Default": "Host=localhost;Port=5432;Database=telewave;Username=telewave;Password=telewave"
+  },
   "Logging": {
     "LogLevel": {
       "Default": "Information",

backend/src/TeleWave.Api/appsettings.json

@@ -1,7 +1,4 @@
 {
-  "ConnectionStrings": {
-    "Default": "Host=localhost;Port=5432;Database=telewave;Username=telewave;Password=telewave"
-  },
   "Jwt": {
     "Issuer": "TeleWave",
     "Audience": "TeleWave",