Tweaks and fixes throughout the project (#27)

This PR contains the work done to do a little bit of housekeeping pass across all packages and the Website service.

To provide further details about the work:
* Refreshed the READMEs and source documentation to match the current code;
* Tagged every test case consistently across the Infrastructure, Localization, Persistence, and Website test targets;
* Removed Website middleware tests now covered by Infrastructure's own suite;
* Conformed the `PrepareDB` method to Sendable;
* Relaxes the production Compose DATABASE_TLS default from require to prefer;
* Added Persistence test verifying the prefer posture falls back to plaintext connections.

Reviewed-on: rock-n-code/loud-amsterdam#27
Co-authored-by: Javier Cicchelli <javier@rock-n-code.com>
Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>

Services/Website/Sources/App/App.swift

@@ -31,9 +31,9 @@ struct App {
             ]
         )
 
-        // Migrate-and-exit mode runs the registered migrations against the configured backend and returns,
-        // so a shared database is migrated by a single deliberate invocation (`--database-migrate`) rather
-        // than by every booting instance.
+        // Migrate-and-exit mode runs the registered migrations against the configured backend and returns, so a shared
+        // database is migrated by a single deliberate invocation (`--database-migrate`) rather than by every booting
+        // instance.
         guard !reader.migrate else {
             try await migration(
                 reader: reader

Services/Website/Sources/App/Extensions/App+Build.swift

@@ -25,8 +25,8 @@ func application(
         logLevel: reader.logLevel
     )
 
-    // A broken catalog degrades to serving raw localization keys rather than failing, so it is
-    // only ever visible to visitors — surface it here instead.
+    // A broken catalog degrades to serving raw localization keys rather than failing, so it is only ever visible to
+    // visitors — surface it here instead.
     if languages.catalogState != .loaded {
         let isCatalogMissing = languages.catalogState == .missing
         
@@ -63,8 +63,8 @@ func application(
 
     app.addServices(fluent)
 
-    // The in-memory backend is recreated on every launch, so it is migrated on startup. The MySQL/MariaDB
-    // backend is left untouched here: a shared database is migrated out of band to avoid multi-instance races.
+    // The in-memory backend is recreated on every launch, so it is migrated on startup. The MySQL/MariaDB backend is
+    // left untouched here: a shared database is migrated out of band to avoid multi-instance races.
     if case .inMemory = reader.driver {
         app.beforeServerStarts {
             try await fluent.migrate()
@@ -137,8 +137,7 @@ private func logger(
 /// larger than `minimumResponseSizeToCompress` when the client advertises support, the localization middleware that negotiates the request's
 /// language from its `Accept-Language` header, the not-found middleware that serves the error page, and the static file middleware that serves the
 /// contents of `staticFilesPath` (tagging responses with the given `cacheControl` directives), then adds the `RootController` routes that
-/// render the landing page, the `SubscriptionController` routes that register newsletter subscriptions, and the `HealthController` routes
-/// that serve the health check.
+/// render the landing page, and the `HealthController` routes that serve the health check.
 ///
 /// The security-headers middleware sits just inside request logging so it covers every response that reaches a client — the landing page, the compressed
 /// responses, the rendered error page, and the served static files.
@@ -162,8 +161,8 @@ private func router(
     logLevel: Logger.Level,
     probe: Probe
 ) -> Router<AppRequestContext> {
-    // HEAD siblings are generated for every GET route, so uptime monitors and crawlers probing
-    // with HEAD requests get the page's status and headers instead of a 404.
+    // HEAD siblings are generated for every GET route, so uptime monitors and crawlers probing with HEAD requests get
+    // the page's status and headers instead of a 404.
     let router = Router(
         context: AppRequestContext.self,
         options: .autoGenerateHeadEndpoints

Services/Website/Sources/App/Extensions/ConfigReader+Properties.swift

@@ -123,9 +123,9 @@ package extension ConfigReader {
 
     /// The rate limit applied to the subscription endpoint, built from the `rateLimit.*` keys.
     ///
-    /// `rateLimit.limit` requests are admitted per client per `rateLimit.window` seconds. When
-    /// `rateLimit.trustForwardedFor` is set, clients are keyed by the first `X-Forwarded-For` entry —
-    /// enable it only behind a reverse proxy that sets the header, since clients can forge it otherwise.
+    /// `rateLimit.limit` requests are admitted per client per `rateLimit.window` seconds. When `rateLimit.trustForwardedFor` is set,
+    /// clients are keyed by the first `X-Forwarded-For` entry — enable it only behind a reverse proxy that sets the header, since clients can forge it
+    /// otherwise.
     var rateLimit: RateLimitMiddleware<AppRequestContext>.Configuration {
         .init(
             limit: int(