Configure VM services and fix auth flow

- point MySQL and Whisper settings to the VM
- add VM MySQL bootstrap scripts and docs
- allow LAN Vite origins for CORS
- fix Express 5 validation assignment crash
- allow login with username or email
- prevent recursive auth refresh retries

docs/API.md

@@ -0,0 +1,46 @@
+# API Guide
+
+Base path: `/api/v1`
+
+All JSON responses follow:
+
+```json
+{
+  "success": true,
+  "message": "Transcript created",
+  "data": {}
+}
+```
+
+## Auth
+
+- `POST /auth/register`
+- `POST /auth/login`
+- `POST /auth/refresh`
+- `GET /auth/me`
+- `POST /auth/logout`
+- `PATCH /auth/profile`
+- `PATCH /auth/password`
+- `POST /auth/forgot-password`
+
+## Audio And Transcription
+
+- `POST /audio/transcribe` accepts multipart field `audio`
+- `GET /transcriptions/:id/status` returns queued, processing, completed, or failed
+- `GET /transcriptions/whisper/health` checks Whisper VM and queue state
+
+## Transcripts
+
+- `GET /transcripts`
+- `GET /transcripts/inbox`
+- `GET /transcripts/sent`
+- `GET /transcripts/:id`
+- `PATCH /transcripts/:id`
+- `DELETE /transcripts/:id`
+- `POST /transcripts/send`
+- `GET /transcripts/:id/audio`
+- `GET /transcripts/:id/download`
+
+## Users
+
+- `GET /users?q=kevin`

docs/REMOTE_DB.md

@@ -0,0 +1,32 @@
+# Remote MySQL Setup
+
+Create a database user that can connect from the API host:
+
+```sql
+CREATE DATABASE orphion CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+CREATE USER 'orphion'@'%' IDENTIFIED BY 'NexaVault2026!Blue';
+GRANT ALL PRIVILEGES ON orphion.* TO 'orphion'@'%';
+FLUSH PRIVILEGES;
+```
+
+Configure:
+
+```env
+DB_HOST=172.16.10.64
+DB_PORT=3306
+DB_NAME=orphion
+DB_USER=orphion
+DB_PASSWORD=NexaVault2026!Blue
+```
+
+For the VM setup, run the database/user bootstrap from this project:
+
+```sh
+sh scripts/bootstrap-vm-mysql.sh <vm-user>@172.16.10.64
+```
+
+That command runs the VM MySQL grant setup and then applies the project schema through:
+
+```sh
+npm run migrate
+```

docs/STORAGE.md

@@ -0,0 +1,46 @@
+# Storage Configuration
+
+Audio is not kept in the API project. Uploads land in a temporary folder and are copied or streamed
+to the configured storage adapter before the temp file is removed.
+
+## Local Development
+
+The sample env stores audio in the repository-level ignored `storage/audio` directory:
+
+```env
+STORAGE_DRIVER=local
+STORAGE_BASE_PATH=../storage/audio
+```
+
+## SMB/NFS Mounted Storage
+
+Mount your storage on the API machine and configure:
+
+```env
+STORAGE_DRIVER=smb
+STORAGE_BASE_PATH=/mnt/orphion-audio
+```
+
+Use `STORAGE_DRIVER=nfs` for the same mounted-filesystem adapter.
+
+## HTTP Storage Server
+
+The HTTP adapter uses `PUT`, `GET`, and `DELETE` against a file server:
+
+```env
+STORAGE_DRIVER=http
+STORAGE_HTTP_BASE_URL=http://192.168.X.X:9000/audio
+STORAGE_HTTP_TOKEN=optional-bearer-token
+```
+
+## S3-Compatible Storage
+
+```env
+STORAGE_DRIVER=s3
+S3_ENDPOINT=http://192.168.X.X:9000
+S3_REGION=us-east-1
+S3_BUCKET=orphion-audio
+S3_ACCESS_KEY_ID=...
+S3_SECRET_ACCESS_KEY=...
+S3_FORCE_PATH_STYLE=true
+```

docs/WHISPER_VM.md

@@ -0,0 +1,32 @@
+# Faster-Whisper VM Setup
+
+The sample env expects the Whisper service to run on the VM at `172.16.10.64:8000`.
+
+The backend expects a Whisper-compatible HTTP service:
+
+```env
+WHISPER_VM_IP=172.16.10.64
+WHISPER_VM_PORT=8000
+WHISPER_API_URL=http://172.16.10.64:8000
+WHISPER_TRANSCRIBE_PATH=/transcribe
+WHISPER_HEALTH_PATH=/health
+WHISPER_FILE_FIELD=file
+WHISPER_ALLOW_MOCK=false
+```
+
+Expected endpoints:
+
+- `GET /health` returns any 2xx status when the VM is ready.
+- `POST /transcribe` accepts multipart audio and returns one of:
+
+```json
+{
+  "transcript_text": "Meeting transcript...",
+  "language": "en",
+  "duration": 123.45,
+  "timestamps": [{ "start": 0, "end": 5, "text": "Hello" }]
+}
+```
+
+The API retries failed requests, applies `WHISPER_TIMEOUT_MS`, and marks jobs as failed when the VM
+is unavailable.