chore: prepare release v0.4.0

config.toml.example

@@ -2,8 +2,17 @@
 # Copy to config.toml and adjust. Keep real admin hashes out of Git.
 
 [server]
-host = "127.0.0.1"
+host = "::"
 port = 9090
+# Environment label: "development" or "production". Affects startup
+# safety checks (session key length, secure cookies, password policy).
+env = "development"
+# Set true ONLY when running behind a trusted reverse proxy that
+# terminates TLS. The proxy must strip client-supplied
+# X-Forwarded-Proto headers.
+trust_proxy = false
+# Set true in production to force `Secure` flag on session cookies.
+cookie_secure = false
 
 content_dir = "./posts"
 users_file = "./users.toml"
@@ -16,7 +25,13 @@ language = "cs"
 author = "Petr Balvín"
 
 [admin]
-# Generate a hash with: bundle exec exe/volumen hash-password
+# Generate a hash with: uv run volumen hash-password
 password_hash = ""
 session_key = ""
 session_ttl = 86400
+# Minimum new-password length (default 10).
+min_password_length = 10
+# Maximum new-password length (cap to avoid scrypt abuse).
+max_password_length = 1024
+# Maximum upload size in bytes (default 10 MB).
+max_upload_bytes = 10485760