Bump elide to latest; store and expose detection intermediates

.env.example

@@ -8,6 +8,10 @@ REQUEST_TIMEOUT=30s
 SHUTDOWN_TIMEOUT=30s
 HEALTH_CACHE_DURATION=30s
 
+# Request body size limits (4 MiB and 100 MiB)
+MAX_BODY_BYTES=4194304
+MAX_FILE_BODY_BYTES=104857600
+
 # TLS (optional)
 TLS_CERT_PATH=./cert.pem
 TLS_KEY_PATH=./key.pem
@@ -32,7 +36,7 @@ OPENAPI_SCALAR_PATH=/api/scalar
 # PostgreSQL
 POSTGRES_URL=postgresql://postgres:postgres@localhost:5432/postgres
 POSTGRES_MAX_CONNECTIONS=10
-POSTGRES_CONNECTION_TIMEOUT=30s
+POSTGRES_CONNECTION_TIMEOUT=10s
 POSTGRES_IDLE_TIMEOUT=10m
 
 # NATS

crates/nvisy-postgres/src/model/workspace_detection.rs

@@ -28,6 +28,10 @@ pub struct WorkspaceDetection {
     /// Audit file (`file_kind = audit`) holding the encrypted analysis. `None`
     /// until analysis writes it.
     pub audit_file_id: Option<Uuid>,
+    /// Intermediates file (`file_kind = intermediate`) holding the encrypted
+    /// enrichment (OCR layout, transcript, tokenized text). `None` until analysis
+    /// writes it, and stays `None` when the analysis ran no enricher.
+    pub intermediates_file_id: Option<Uuid>,
     /// How the detection was initiated.
     pub trigger_type: PipelineTriggerType,
     /// Current detection status.
@@ -59,6 +63,9 @@ pub struct NewWorkspaceDetection {
     pub input_file_id: Uuid,
     /// Audit file holding the encrypted analysis (set once analyzed).
     pub audit_file_id: Option<Uuid>,
+    /// Intermediates file holding the encrypted enrichment (set once analyzed, if
+    /// the document produced any).
+    pub intermediates_file_id: Option<Uuid>,
     /// Trigger type.
     pub trigger_type: Option<PipelineTriggerType>,
     /// Initial status.
@@ -78,6 +85,8 @@ pub struct UpdateWorkspaceDetection {
     pub status: Option<DetectionStatus>,
     /// Audit file holding the encrypted analysis.
     pub audit_file_id: Option<Option<Uuid>>,
+    /// Intermediates file holding the encrypted enrichment.
+    pub intermediates_file_id: Option<Option<Uuid>>,
     /// Non-encrypted metadata for filtering/display.
     pub metadata: Option<Json<DetectionMetadata>>,
     /// When a worker last claimed this detection (lease timestamp).

crates/nvisy-postgres/src/schema.rs

@@ -289,6 +289,7 @@ diesel::table! {
         account_id -> Uuid,
         input_file_id -> Uuid,
         audit_file_id -> Nullable<Uuid>,
+        intermediates_file_id -> Nullable<Uuid>,
         trigger_type -> PipelineTriggerType,
         status -> DetectionStatus,
         idempotency_key -> Nullable<Text>,

crates/nvisy-postgres/src/types/enums/file_kind.rs

@@ -36,6 +36,14 @@ pub enum FileKind {
     #[db_rename = "review"]
     #[serde(rename = "review")]
     Review,
+
+    /// Enrichment content a detection extracted from a non-text document — an
+    /// image's OCR layout, an audio clip's transcript — served to the client so a
+    /// reviewer can search it and add entities the analysis missed. Carries
+    /// document content, not shown in file lists.
+    #[db_rename = "intermediate"]
+    #[serde(rename = "intermediate")]
+    Intermediate,
 }
 
 impl FileKind {

crates/nvisy-postgres/src/types/json/pipeline_metadata.rs

@@ -36,6 +36,8 @@ pub struct RetentionOverride {
     pub redacted_documents: Option<Retention>,
     /// Overrides audit-blob retention when set.
     pub audit_logs: Option<Retention>,
+    /// Overrides enrichment-intermediate retention when set.
+    pub intermediates: Option<Retention>,
 }
 
 impl RetentionOverride {
@@ -47,6 +49,7 @@ impl RetentionOverride {
             RetentionScope::OriginalDocuments => None,
             RetentionScope::RedactedDocuments => self.redacted_documents,
             RetentionScope::AuditLogs => self.audit_logs,
+            RetentionScope::Intermediates => self.intermediates,
         }
     }
 }