feat(todo): the server finds places through the instance's Photon (ADR 0033, D32)

Todo's locations search through the person's own instance, as Train's
planner does, not a public service: `SearchEndpoint` on `PlaceSearch`, for
those signed in, 60 searches a minute, nothing kept or logged. Its `Place`
carries the address's parts and the object in OpenStreetMap, and a shop's
car park or charger is left out, which came first for `Lindau EDEKA`.

`compose.todo-search.yaml` puts Todo's server on compose.search.yaml's
Photon. A file of its own: without it Todo starts as it did, and offers no
search.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/.env.example

@@ -42,7 +42,8 @@ LEARN_DOMAIN=http://localhost
 # PostgreSQL, Learn's server with the register), then the sidecars switched on beside it
 # (sidecars/README.md): compose.jellyfin.yaml, a Jellyfin people watch and listen to
 # learn from; compose.languagetool.yaml, spelling and grammar checked; compose.train.yaml,
-# Halkyon Train's server with its BRouter; compose.todo.yaml, Halkyon Todo's server.
+# Halkyon Train's server with its BRouter; compose.todo.yaml, Halkyon Todo's server;
+# compose.todo-search.yaml, Todo on compose.search.yaml's Photon, after both.
 # Always set: no file has Compose's default name (compose.yaml until 2 Nov 2026), so
 # without it `docker compose` finds none (e.g. compose.learn.yaml:compose.jellyfin.yaml).
 COMPOSE_FILE=compose.learn.yaml

deploy/compose.search.yaml

@@ -1,10 +1,10 @@
 # Place search for Halkyon Train (ADR 0030, D50), beside compose.train.yaml, which it
-# needs: Photon on GraphHopper's weekly database of Europe, asked by Train's server
-# alone. Switched on in .env:
+# needs: Photon on GraphHopper's weekly database of Europe, asked by Train's server,
+# and by Todo's where compose.todo-search.yaml joins it. Switched on in .env:
 #
 #   COMPOSE_FILE=compose.learn.yaml:compose.train.yaml:compose.search.yaml
 #
-# Photon has no site and no sign-in: only Train's server reaches it, on a network of
+# Photon has no site and no sign-in: only the apps' servers reach it, on a network of
 # their own without a way out, for people signed in, and nothing it is asked is kept
 # or logged. Its database (Europe's: a 32.6 GB download on 29 Oct 2026, more
 # unpacked, to be measured) is in ./photon/data, renewed monthly, owned by a user ID of
@@ -27,7 +27,7 @@ services:
       PHOTON_HEAP: ${PHOTON_HEAP:-6g}
     volumes:
       - ./photon/data:/data
-    # Beside Train's server alone: no site, no published port, no way out.
+    # Beside the apps' servers alone: no site, no published port, no way out.
     networks:
       - search
     mem_limit: ${PHOTON_MEMORY:-8g}
@@ -63,7 +63,7 @@ services:
       - search
 
 networks:
-  # Train's server and Photon, without a way out.
+  # The apps' servers and Photon, without a way out.
   search:
     internal: true
   downloads:

deploy/compose.todo-search.yaml

@@ -0,0 +1,16 @@
+# Place search for Halkyon Todo (ADR 0033, D32): Todo's server on the Photon of
+# compose.search.yaml, which Train's server asks too. After both in .env:
+#
+#   COMPOSE_FILE=…:compose.todo.yaml:compose.search.yaml:compose.todo-search.yaml
+#
+# A file of its own: Todo starts without it, its app offering no search, and an instance
+# may run Photon for Train without Todo. Only Todo's server asks, for people signed in,
+# and neither what is searched nor what is found is kept or logged; a task's location is
+# sealed on the person's devices. Setting it up: sidecars/README.md, Todo.
+
+services:
+  todo-server:
+    environment:
+      PHOTON_URL: http://photon:2322/
+    networks:
+      - search

deploy/sidecars/README.md

@@ -24,6 +24,7 @@ site changes.
 | Train's own map tiles, beside Train | `compose.maps.yaml` | `train-maps.caddy` (in Train's site) |
 | Photon, which finds places for Train's route planner, beside Train | `compose.search.yaml` | none |
 | Halkyon Todo's server | `compose.todo.yaml` | `todo.caddy` |
+| Todo's place search, on Train's Photon | `compose.todo-search.yaml` | none |
 
 Both together: `COMPOSE_FILE=compose.learn.yaml:compose.jellyfin.yaml:compose.languagetool.yaml`.
 
@@ -519,3 +520,10 @@ Steps, in order:
    instance is away for seconds. Todo's server applies its migrations as it starts.
 5. **Check it**: `https://todo.halkyon.eu/` answers; in Todo, signed in with a Learn
    account, a task added on one device shows on another.
+6. **Place search** (optional; ADR 0033, D32): Todo's locations find places through the
+   Photon of *Train's search*, set up first. In `deploy/.env`,
+   `compose.todo-search.yaml` added to `COMPOSE_FILE` after `compose.todo.yaml` and
+   `compose.search.yaml`, then `docker compose up -d`, which recreates Todo's server
+   alone. Without it Todo starts as it did, and its app offers no search. Nothing
+   searched is kept or logged, and a task's location stays sealed on the person's
+   devices.