feat(ai): semantic-search backfill worker + Ollama compose profile (RECOMMENDATIONS #4a)

First activation slice of semantic search (docs/discovery/05+06):
- EmbeddingBackfillWorker: fills Email.Embedding in small batches (32, 2s pause,
  newest first; subject+snippet, truncated) so interactive load is never starved.
  Exits immediately when the embedding provider is unavailable — AI-off deployments
  are untouched, Ollama hiccups back off instead of crashing the host.
- compose: optional 'ollama' service under the 'ai' profile (persistent model
  volume, commented GPU passthrough for the RTX 3080); api gets
  Ai__OllamaBaseUrl pointing at it.
- LiveDb test proves the worker persists 768-dim vectors against real pgvector
  (deterministic fake provider); LiveDb classes serialised into one xUnit
  collection (concurrent MigrateAsync on a fresh DB races — found while testing).

Verified against REAL Ollama locally: pulled nomic-embed-text in a container and
confirmed the /api/embeddings contract the provider uses returns 768-dim vectors.
Full suite 55 green (4 LiveDb vs real pgvector); format clean.

Next slice: hybrid RRF ranking in SearchService once embeddings exist.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -15,6 +15,3 @@ FRONTEND_ORIGIN=http://localhost:8081
 # Set DEV_MODE=true and MAX_MESSAGES=1000 to test against a large mailbox.
 DEV_MODE=false
 MAX_MESSAGES=0
-
-# Nightly DB backup rotation (days of dumps to keep in ./backups)
-BACKUP_KEEP_DAYS=7

.gitea/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '10.0.x'
+          dotnet-version: '8.0.x'
       - name: Restore
         run: dotnet restore InboxIntel.sln
       - name: Build
@@ -45,7 +45,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '10.0.x'
+          dotnet-version: '8.0.x'
       - name: dotnet format (verify only)
         run: dotnet format InboxIntel.sln --verify-no-changes
 
@@ -67,7 +67,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '10.0.x'
+          dotnet-version: '8.0.x'
       - name: Wait for Postgres
         run: |
           for i in $(seq 1 30); do

.gitea/workflows/renovate.yml

@@ -1,35 +0,0 @@
-name: Renovate
-
-# RECOMMENDATIONS #2: automated dependency-update PRs (NuGet, npm, Dockerfiles, Actions)
-# that ride the existing required CI gates. Runs weekly + on demand.
-#
-# ONE-TIME SETUP (manual): create a Gitea personal access token with scopes
-# repo (rw) + user (r) + issue (rw) + organization (r), and add it as the Actions
-# secret RENOVATE_TOKEN (repo Settings -> Actions -> Secrets). Without the secret this
-# workflow fails fast with a clear message. See https://docs.renovatebot.com/modules/platform/gitea/
-on:
-  schedule:
-    - cron: '30 4 * * 1'      # Mondays 04:30 UTC
-  workflow_dispatch: {}
-
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Require RENOVATE_TOKEN
-        run: |
-          if [ -z "${{ secrets.RENOVATE_TOKEN }}" ]; then
-            echo "RENOVATE_TOKEN secret is not set — see the comment at the top of this workflow." >&2
-            exit 1
-          fi
-      - name: Run Renovate
-        uses: https://github.com/renovatebot/github-action@v40.3.6
-        with:
-          token: ${{ secrets.RENOVATE_TOKEN }}
-        env:
-          RENOVATE_PLATFORM: gitea
-          RENOVATE_ENDPOINT: https://git.cesnimda.uk/api/v1
-          RENOVATE_REPOSITORIES: cesnimda/Inboxintel
-          RENOVATE_ONBOARDING: "false"
-          RENOVATE_REQUIRE_CONFIG: optional
-          LOG_LEVEL: info

.gitea/workflows/security.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-dotnet@v4
         with:
-          dotnet-version: '10.0.x'
+          dotnet-version: '8.0.x'
       - name: Restore
         run: dotnet restore InboxIntel.sln
       - name: .NET vulnerable packages (fail on any)

.gitignore

@@ -21,9 +21,6 @@ frontend/.vite/
 appsettings.*.local.json
 secrets.json
 
-## DB backups (never commit dumps)
-backups/
-
 ## Logs
 logs/
 *.log

Directory.Build.props

@@ -1,6 +1,6 @@
 <Project>
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net8.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
     <LangVersion>latest</LangVersion>

SECURITY.md

@@ -29,9 +29,7 @@ reverse proxy.
    mitigate (a third party reading the DB files) reduces to "someone with access to your
    machine" — mitigate it at the layer that actually works:
    - **Use full-disk or volume encryption** on the host (BitLocker/LUKS) — strongly recommended.
-   - **Encrypt backups**: nightly `pg_dump` rotation runs via the compose `backup` service
-     into `./backups/` (git-ignored) — keep that directory on an encrypted disk and copy it
-     off-machine. Restore: `docker compose exec -T postgres psql -U inboxintel -d inboxintel < backups/<file>.sql`.
+   - **Encrypt backups** of the `pgdata` volume the same way.
    - Before any **multi-user** deployment, revisit per the multi-provider security design
      (host admins must not be able to read members' mail — plaintext bodies break that promise).
 2. **DB connection is not TLS** — Postgres is only reachable on the compose-internal network /

docker-compose.yml

@@ -22,37 +22,6 @@ services:
       timeout: 5s
       retries: 10
 
-  # Nightly logical backups (RECOMMENDATIONS #3 — previously there were NONE). Dumps
-  # rotate after BACKUP_KEEP_DAYS. The ./backups host directory should live on an
-  # encrypted disk and be included in your off-machine backup regime (see SECURITY.md).
-  # Restore: docker compose exec -T postgres psql -U inboxintel -d inboxintel < backups/<file>.sql
-  backup:
-    image: pgvector/pgvector:pg16
-    entrypoint: /bin/sh
-    command:
-      - -c
-      - |
-        while true; do
-          ts=$$(date -u +%Y%m%d-%H%M%S)
-          if pg_dump -h postgres -U inboxintel -d inboxintel > /backups/inboxintel-$$ts.sql.tmp; then
-            mv /backups/inboxintel-$$ts.sql.tmp /backups/inboxintel-$$ts.sql
-            echo "backup OK: inboxintel-$$ts.sql"
-          else
-            rm -f /backups/inboxintel-$$ts.sql.tmp
-            echo "backup FAILED at $$ts" >&2
-          fi
-          find /backups -name 'inboxintel-*.sql' -mtime +$${BACKUP_KEEP_DAYS:-7} -delete
-          sleep 86400
-        done
-    environment:
-      PGPASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in deploy/.env}
-      BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS:-7}
-    volumes:
-      - ./backups:/backups
-    depends_on:
-      postgres:
-        condition: service_healthy
-
   api:
     build:
       context: .
@@ -67,8 +36,6 @@ services:
       Ai__Mode: ${AI_MODE:-Disabled}
       # Points at the compose 'ollama' service when the ai profile is up; harmless otherwise.
       Ai__OllamaBaseUrl: ${OLLAMA_BASE_URL:-http://ollama:11434}
-      # OTLP export activates only when set (e.g. http://lgtm:4317 with the observability profile).
-      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_ENDPOINT:-}
       # Dev mode shows the dev banner and caps the initial sync. Set DEV_MODE=true
       # and MAX_MESSAGES=1000 in deploy/.env to exercise it in this Docker setup.
       App__DevMode: ${DEV_MODE:-false}
@@ -111,16 +78,6 @@ services:
     #           count: all
     #           capabilities: [gpu]
 
-  # Observability (RECOMMENDATIONS #5): all-in-one Grafana+Tempo+Prometheus+Loki.
-  # Enable with: docker compose --profile observability up -d
-  # then set OTEL_ENDPOINT=http://lgtm:4317 in deploy/.env and restart the api.
-  # Grafana UI: http://localhost:3000 (admin/admin on first run).
-  lgtm:
-    image: grafana/otel-lgtm
-    profiles: ["observability"]
-    ports:
-      - "127.0.0.1:3000:3000"
-
   # Optional reverse proxy. Enable with: docker compose --profile proxy up
   nginx:
     image: nginx:alpine

frontend/src/main.jsx

@@ -1,53 +1,42 @@
-import React, { Suspense, lazy } from 'react';
+import React from 'react';
 import ReactDOM from 'react-dom/client';
 import { BrowserRouter, Routes, Route, Navigate } from 'react-router-dom';
 import Landing from './pages/Landing.jsx';
+import Dashboard from './pages/Dashboard.jsx';
+import Senders from './pages/Senders.jsx';
+import Cleanup from './pages/Cleanup.jsx';
+import Unsubscribe from './pages/Unsubscribe.jsx';
+import FolderView from './pages/FolderView.jsx';
+import SearchResults from './pages/SearchResults.jsx';
 import Layout from './components/Layout.jsx';
+import DesignSystem from './pages/DesignSystem.jsx';
 import { ToastProvider, TooltipProvider } from './components/ui';
 import '@fontsource-variable/inter';
 import './index.css';
 import './styles.css';
 
-// Route-level code splitting: each page loads its own chunk on first visit, so the
-// initial bundle no longer carries Chart.js / grid-layout / every page at once.
-// Landing + Layout stay eager (they're the first paint).
-const Dashboard = lazy(() => import('./pages/Dashboard.jsx'));
-const Senders = lazy(() => import('./pages/Senders.jsx'));
-const Cleanup = lazy(() => import('./pages/Cleanup.jsx'));
-const Unsubscribe = lazy(() => import('./pages/Unsubscribe.jsx'));
-const FolderView = lazy(() => import('./pages/FolderView.jsx'));
-const SearchResults = lazy(() => import('./pages/SearchResults.jsx'));
-const DesignSystem = lazy(() => import('./pages/DesignSystem.jsx'));
-
-// Minimal, theme-correct route fallback (skeleton-style, per the design system).
-const RouteFallback = () => (
-  <div className="p-6 text-sm text-muted-foreground" aria-busy="true">Loading…</div>
-);
-
 ReactDOM.createRoot(document.getElementById('root')).render(
   <React.StrictMode>
     <ToastProvider>
       <TooltipProvider delayDuration={200}>
         <BrowserRouter>
-          <Suspense fallback={<RouteFallback />}>
-            <Routes>
-              {/* Public landing page */}
-              <Route path="/" element={<Landing />} />
+          <Routes>
+        {/* Public landing page */}
+        <Route path="/" element={<Landing />} />
 
-              {/* Authenticated app */}
-              <Route path="/app" element={<Layout />}>
-                <Route index element={<Dashboard />} />
-                <Route path="senders" element={<Senders />} />
-                <Route path="cleanup" element={<Cleanup />} />
-                <Route path="unsubscribe" element={<Unsubscribe />} />
-                <Route path="folder/:slug" element={<FolderView />} />
-                <Route path="search" element={<SearchResults />} />
-                <Route path="design" element={<DesignSystem />} />
-              </Route>
+        {/* Authenticated app */}
+        <Route path="/app" element={<Layout />}>
+          <Route index element={<Dashboard />} />
+          <Route path="senders" element={<Senders />} />
+          <Route path="cleanup" element={<Cleanup />} />
+          <Route path="unsubscribe" element={<Unsubscribe />} />
+          <Route path="folder/:slug" element={<FolderView />} />
+          <Route path="search" element={<SearchResults />} />
+          <Route path="design" element={<DesignSystem />} />
+        </Route>
 
-              <Route path="*" element={<Navigate to="/" replace />} />
-            </Routes>
-          </Suspense>
+            <Route path="*" element={<Navigate to="/" replace />} />
+          </Routes>
         </BrowserRouter>
       </TooltipProvider>
     </ToastProvider>

renovate.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "timezone": "Europe/Berlin",
-  "schedule": ["before 6am on monday"],
-  "labels": ["dependencies"],
-  "prConcurrentLimit": 5,
-  "commitMessagePrefix": "chore(deps):",
-  "packageRules": [
-    {
-      "description": "Group safe minor+patch updates into one weekly PR per ecosystem",
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "{{manager}} minor & patch"
-    },
-    {
-      "description": "Major updates stay individual PRs for careful review",
-      "matchUpdateTypes": ["major"],
-      "dependencyDashboardApproval": true
-    }
-  ],
-  "vulnerabilityAlerts": {
-    "enabled": true,
-    "labels": ["security"],
-    "schedule": ["at any time"]
-  },
-  "ignorePaths": ["**/node_modules/**", "**/bin/**", "**/obj/**"]
-}

src/InboxIntel.Api/Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage build for the ASP.NET Core API.
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
 WORKDIR /src
 
 # Copy solution + project files first for layer-cached restore.
@@ -13,7 +13,7 @@ RUN dotnet restore src/InboxIntel.Api/InboxIntel.Api.csproj
 COPY src/ src/
 RUN dotnet publish src/InboxIntel.Api/InboxIntel.Api.csproj -c Release -o /app/publish /p:UseAppHost=false
 
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
+FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS runtime
 WORKDIR /app
 COPY --from=build /app/publish .
 

src/InboxIntel.Api/InboxIntel.Api.csproj

@@ -5,21 +5,16 @@
     <UserSecretsId>210c6d96-c7e4-4ee9-8982-8b91424979b8</UserSecretsId>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.Google" Version="10.0.9" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.Google" Version="8.0.7" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.7" />
     <!-- Required on the startup project for `dotnet ef migrations` to work. -->
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.4">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Asp.Versioning.Mvc" Version="8.1.0" />
     <PackageReference Include="Asp.Versioning.Mvc.ApiExplorer" Version="8.1.0" />
     <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" />
-    <PackageReference Include="Npgsql.OpenTelemetry" Version="10.0.3" />
-    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.16.0" />
     <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
     <PackageReference Include="Serilog.Sinks.Console" Version="5.0.1" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />

src/InboxIntel.Api/Program.cs

@@ -16,10 +16,6 @@ using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Options;
-using Npgsql;
-using OpenTelemetry.Metrics;
-using OpenTelemetry.Resources;
-using OpenTelemetry.Trace;
 using Serilog;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -42,8 +38,8 @@ var dp = builder.Services.AddDataProtection()
 var dpCertPath = builder.Configuration["DataProtection:CertificatePath"];
 if (!string.IsNullOrWhiteSpace(dpCertPath))
 {
-    dp.ProtectKeysWithCertificate(System.Security.Cryptography.X509Certificates.X509CertificateLoader
-        .LoadPkcs12FromFile(dpCertPath, builder.Configuration["DataProtection:CertificatePassword"]));
+    dp.ProtectKeysWithCertificate(new System.Security.Cryptography.X509Certificates.X509Certificate2(
+        dpCertPath, builder.Configuration["DataProtection:CertificatePassword"]));
 }
 
 builder.Services.AddApplication();
@@ -126,28 +122,6 @@ builder.Services.AddAuthentication(options =>
 
 builder.Services.AddAuthorization();
 
-// RECOMMENDATIONS #5: OpenTelemetry traces + metrics (ASP.NET, outbound HTTP, Npgsql).
-// The OTLP exporter only activates when Otel:Endpoint (or the standard
-// OTEL_EXPORTER_OTLP_ENDPOINT env var) is configured — zero overhead otherwise.
-// Logs stay on Serilog. Pair with the compose "observability" profile (grafana/otel-lgtm).
-var otlpEndpoint = builder.Configuration["Otel:Endpoint"]
-    ?? Environment.GetEnvironmentVariable("OTEL_EXPORTER_OTLP_ENDPOINT");
-if (!string.IsNullOrWhiteSpace(otlpEndpoint))
-{
-    builder.Services.AddOpenTelemetry()
-        .ConfigureResource(r => r.AddService("inboxintel-api"))
-        .WithTracing(t => t
-            .AddAspNetCoreInstrumentation()
-            .AddHttpClientInstrumentation()
-            .AddNpgsql()
-            .AddOtlpExporter(o => o.Endpoint = new Uri(otlpEndpoint)))
-        .WithMetrics(m => m
-            .AddAspNetCoreInstrumentation()
-            .AddHttpClientInstrumentation()
-            .AddNpgsqlInstrumentation()
-            .AddOtlpExporter(o => o.Endpoint = new Uri(otlpEndpoint)));
-}
-
 builder.Services.AddApiVersioning(o =>
 {
     o.DefaultApiVersion = new ApiVersion(1, 0);
@@ -227,14 +201,15 @@ var forwardedOptions = new ForwardedHeadersOptions
     ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost,
     ForwardLimit = app.Configuration.GetValue<int?>("ForwardedHeaders:ForwardLimit") ?? 1
 };
-forwardedOptions.KnownIPNetworks.Clear();
+forwardedOptions.KnownNetworks.Clear();
 forwardedOptions.KnownProxies.Clear();
 var trustedNetworks = app.Configuration.GetSection("ForwardedHeaders:KnownNetworks").Get<string[]>()
     ?? new[] { "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "::1/128" };
 foreach (var cidr in trustedNetworks)
 {
-    if (System.Net.IPNetwork.TryParse(cidr, out var network))
-        forwardedOptions.KnownIPNetworks.Add(network);
+    var parts = cidr.Split('/');
+    if (parts.Length == 2 && System.Net.IPAddress.TryParse(parts[0], out var prefix) && int.TryParse(parts[1], out var len))
+        forwardedOptions.KnownNetworks.Add(new Microsoft.AspNetCore.HttpOverrides.IPNetwork(prefix, len));
 }
 app.UseForwardedHeaders(forwardedOptions);
 

src/InboxIntel.Application/InboxIntel.Application.csproj

@@ -6,13 +6,13 @@
   <ItemGroup>
     <PackageReference Include="FluentValidation" Version="11.9.2" />
     <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.9.2" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.9" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="8.0.2" />
     <!-- DbSet<> is exposed on IAppDbContext so the Application layer can query.
          Pinned to 8.0.4 to match the Npgsql provider's Relational dependency. -->
-    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.4" />
     <!-- Transitive security pins: patch known .NET 8.0.0 advisories pulled in by EF Core. -->
-    <PackageReference Include="System.Text.Json" Version="10.0.9" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.9" />
+    <PackageReference Include="System.Text.Json" Version="8.0.6" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\InboxIntel.Domain\InboxIntel.Domain.csproj" />

src/InboxIntel.Domain/InboxIntel.Domain.csproj

@@ -6,7 +6,7 @@
   <ItemGroup>
     <!-- NpgsqlTypes.NpgsqlTsVector (FTS) and Pgvector.Vector (semantic search) are used as
          column types on the Email entity — same pragmatic precedent for both. -->
-    <PackageReference Include="Npgsql" Version="10.0.2" />
-    <PackageReference Include="Pgvector" Version="0.3.0" />
+    <PackageReference Include="Npgsql" Version="8.0.3" />
+    <PackageReference Include="Pgvector" Version="0.2.0" />
   </ItemGroup>
 </Project>

src/InboxIntel.Infrastructure/InboxIntel.Infrastructure.csproj

@@ -4,18 +4,18 @@
     <AssemblyName>InboxIntel.Infrastructure</AssemblyName>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="8.0.4" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="8.0.4" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.4">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Google.Apis.Gmail.v1" Version="1.68.0.3427" />
     <PackageReference Include="Google.Apis.Auth" Version="1.68.0" />
-    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="10.0.9" />
-    <PackageReference Include="Microsoft.Extensions.Http" Version="10.0.9" />
-    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.9" />
-    <PackageReference Include="Pgvector.EntityFrameworkCore" Version="0.3.0" />
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="8.0.7" />
+    <PackageReference Include="Microsoft.Extensions.Http" Version="8.0.0" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
+    <PackageReference Include="Pgvector.EntityFrameworkCore" Version="0.2.0" />
     <PackageReference Include="Polly" Version="8.4.1" />
     <PackageReference Include="QuestPDF" Version="2024.7.0" />
     <PackageReference Include="CsvHelper" Version="33.0.1" />
@@ -24,9 +24,9 @@
     <!-- Transitive security pins: patch known .NET 8.0.0 advisories pulled in by
          EF Core / ASP.NET / DataProtection. Remove once the parent packages ship
          these versions transitively. -->
-    <PackageReference Include="System.Text.Json" Version="10.0.9" />
-    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="10.0.9" />
-    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.9" />
+    <PackageReference Include="System.Text.Json" Version="8.0.6" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="8.0.3" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\InboxIntel.Application\InboxIntel.Application.csproj" />

tests/InboxIntel.IntegrationTests/AuditFixesTests.cs

@@ -25,7 +25,7 @@ namespace InboxIntel.IntegrationTests;
 /// endpoints (model validation, per-user rate limits) without a real Google login.</summary>
 public class TestAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>
 {
-    public new const string Scheme = "Test";
+    public const string Scheme = "Test";
     // Stable across requests so per-user rate-limit partitions accumulate correctly.
     public static readonly string Uid = Guid.NewGuid().ToString();
 
@@ -52,9 +52,6 @@ public class AuditTestAppFactory : WebApplicationFactory<Program>
         builder.ConfigureHostConfiguration(cfg => cfg.AddInMemoryCollection(new Dictionary<string, string?>
         {
             ["Database:AutoMigrate"] = "false",
-            // Npgsql 10 eagerly validates the connection string when the DbContext is
-            // resolved (8.x was lazy); these tests never connect, but the string must parse.
-            ["ConnectionStrings:Postgres"] = "Host=localhost;Database=test;Username=test;Password=test",
             ["GoogleOAuth:ClientId"] = "test-client-id",
             ["GoogleOAuth:ClientSecret"] = "test-client-secret",
             // H-2: make the auth policy trip on the 3rd request within the window.

tests/InboxIntel.IntegrationTests/AuthEndpointsTests.cs

@@ -19,9 +19,6 @@ public class TestAppFactory : WebApplicationFactory<Program>
         builder.ConfigureHostConfiguration(cfg => cfg.AddInMemoryCollection(new Dictionary<string, string?>
         {
             ["Database:AutoMigrate"] = "false",
-            // Npgsql 10 eagerly validates the connection string when the DbContext is
-            // resolved (8.x was lazy); these tests never connect, but the string must parse.
-            ["ConnectionStrings:Postgres"] = "Host=localhost;Database=test;Username=test;Password=test",
             // Dummy OAuth creds so the Google challenge produces a real 302 redirect
             // (an empty ClientId can make the handler throw instead of redirecting).
             ["GoogleOAuth:ClientId"] = "test-client-id",

tests/InboxIntel.IntegrationTests/InboxIntel.IntegrationTests.csproj

@@ -7,8 +7,8 @@
     <PackageReference Include="xunit" Version="2.9.0" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
     <PackageReference Include="FluentAssertions" Version="6.12.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="8.0.7" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="8.0.4" />
   </ItemGroup>
   <ItemGroup>
     <ProjectReference Include="..\..\src\InboxIntel.Api\InboxIntel.Api.csproj" />