Release (0.31.0) Community: launch-ready forum, opt-in module links, starter templates

The forum shipped in 0.8.57 with the hard part already finished — a read model
that carries its visibility rules as SQL, so nothing leaks even from an endpoint
that forgot to filter. What was missing was everything between "the API is
correct" and "a stranger arrives from Hacker News and stays".

Capability

• A visitor can start a thread, not only reply to one. Its own switch, off by
  default, separate from replies — answering in a thread somebody opened and
  opening one yourself are different amounts of trust. Under pre-moderation the
  whole thread is held (created private, flipped on approval); holding just the
  first post still published the title, which is the half a spammer wants
  published.
• Search over titles and bodies, carrying the same visibility predicates, so
  a private thread, a redacted message, and anything before a channel's history
  cutoff stay out of results as well as out of the page. ILIKE + trigram GIN
  rather than tsvector: the tests run on SQLite, and a query the tests cannot
  execute is a query nobody checks.
• Accepted answers, settable by the asker or an admin. The thread hoists and
  badges it and describes itself as a QAPage with an acceptedAnswer.
• Reactions from a fixed palette. Counts are shared and cacheable; "did I
  react" is a separate call, because the thread payload is served to every
  anonymous reader and cannot carry per-viewer state.
• Member profiles for people who chose to be named. An anonymous poster has
  no handle and no page — a profile link is exactly how anonymity comes undone.
  Handles are derived per community, salted with the workspace id.
• The team is notified. An outsider's post created nothing at all before, so
  a question sat on a public page until an admin happened to look.

Fixes

• A reply appears immediately. The author was returned to a cached page that did
  not contain what they had just written, and read it as a failed save.
• Page 2 exists. The API always took limit/offset; no page ever read one, so
  topic 51 was unreachable by a person or a crawler.
• Signing in from a forum no longer mints an internal account. The backend
  has always honoured context=community; /login never forwarded it, so the
  isolation middleware written to contain those accounts never fired once.
• The public pages are on the brand instead of generic grey, while the header
  still carries the tenant's own name, logo and accent — an accent that was
  stored, served over the API, and applied to nothing.
• Every string on the public and settings pages is translated. Four of five pages
  were hardcoded English.

Plus a social card per thread, an RSS feed, and the directory in the sitemap and
the site's own navigation.

Starter templates

Four shapes that lay out channels, seed first threads, and set participation
defaults. Idempotent by channel slug, so a second click reports what it skipped
rather than leaving you with help and help-a1b2c3. Publishing stays a
separate decision, and a template's participation settings are defaults —
written on first setup only, so re-applying one to add a channel cannot re-open
replies on a forum whose owner deliberately closed them.

Linking (both switches ship off)

A Service Desk ticket's answer, or a document, can become a public thread. Two
independent per-workspace switches, because a workspace may well want its docs
public and its customer ticket traffic emphatically not.

Nothing is published as it arrived: the composer is pre-filled and a person edits
it, because a customer's email contains the customer and no redaction heuristic
is good enough to run that unattended. A document gets an intro rather than a
copy of itself — a document is edited after publishing, and a stale copy on a
public page is worse than none.

Verification

Driven against the live stack, not just tests: migration applied, a community
seeded, then asked a question, replied, reacted, marked an answer, searched,
viewed a profile, checked RSS and both sitemaps, and mobile. The opt-in gates
confirmed empty→populated as each switch flipped. The anonymity guarantee
confirmed to remove the name, the handle and the profile page together. Search
confirmed to return 200 up to its budget and then 429.

972 backend tests, 638 frontend tests, tsc clean, 0 lint errors, the six
community backend modules mypy-clean, and the production build compiles all
nine new routes.

Reviewing this

The three commits are worth reading in order — the second and third are a
self-review of the first and say plainly what was shipped broken:

1. 09174063 the feature
2. 38d7e83f six gaps found reviewing it, including a docs link that had a
   backend and no UI, and a template that silently reset moderation policy
3. b9a214b5 the remaining hardening — search budget, shadowed slugs, typed
   seams

Two things to know

• The migration is two files. migrate_2026_08_25_community_launch.sql and
  migrate_2026_08_25_community_reserved_slugs.sql. The second is separate
  because the first had already been applied, and the schema_migrations
  checksum exists precisely so an applied migration cannot be edited underneath
  a database that ran it.
• The routing fix is preventive, not retroactive for anything a crawler has
  already indexed — but nothing can have been: the URLs it repairs never
  resolved.