Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@backend/internal/data/search/database.go`:
- Around line 133-155: The code uses sync.Once (e.unaccentOnce) in
unaccentAvailable which can permanently cache a transient context-cancel/timeout
failure; replace the sync.Once approach with an explicit lock + checked flag so
transient ctx errors don't mark the probe as finished: add (or use) a mutex
(e.g., unaccentMu) and a bool (e.g., unaccentChecked) on DatabaseEngine, then in
unaccentAvailable acquire the mutex, if unaccentChecked return e.unaccent; run
the probe using the provided ctx, but if the probe fails due to ctx
cancellation/deadline (ctx.Err()==context.Canceled or context.DeadlineExceeded)
do not set unaccentChecked and return (so future calls will retry); only set
e.unaccent and unaccentChecked=true when the probe completes without a
caller-context cancellation (successful probe or definitive DB response).
Reference: unaccentAvailable, e.unaccentOnce, e.unaccent (replace e.unaccentOnce
use with unaccentMu + unaccentChecked).

In `@backend/internal/data/search/meilisearch.go`:
- Around line 357-397: The reindex loop builds `indexed` from multiple
offset-paged queries which is not a stable snapshot and can miss concurrent
mutations; to fix, make `reindex` first capture a stable list of target entity
IDs (e.g., call the same query but use .IDs(ctx) or a single transaction to
collect all entity IDs matching the filters) and then iterate that static slice
in batches (using meiliReindexBatch) to load full entities, call
buildMeiliDocument, add documents with e.index.AddDocumentsWithContext and
populate the `indexed` set from the static ID list; finally call pruneStale with
that `indexed` set so pruning is based on the immutable snapshot rather than
offset-paged, concurrently-changing results.

In `@backend/internal/sys/config/conf_search_test.go`:
- Around line 12-21: The test Test_SearchConf_Defaults reads environment
variables via conf.Parse so make it deterministic by clearing the relevant
HBOXTEST_* env keys before parsing: in the test (before calling conf.Parse) call
t.Setenv("HBOXTEST_SEARCH_DRIVER", ""),
t.Setenv("HBOXTEST_SEARCH_MEILISEARCH_HOST", ""),
t.Setenv("HBOXTEST_SEARCH_MEILISEARCH_INDEX", ""), and
t.Setenv("HBOXTEST_SEARCH_MEILISEARCH_MAXHITS", "") (or any other HBOXTEST_*
keys your config reads) so conf.Parse uses the code defaults; keep the rest of
the assertions unchanged.

In `@backend/internal/sys/config/conf.go`:
- Around line 80-81: The Meilisearch config exposes Host and APIKey without
enforcing secure transport; add a validation routine (e.g., ValidateMeiliConfig
or a method Validate on the struct that contains Host and APIKey) that parses
Host as a URL and returns an error if the scheme is not "https" unless the host
is explicitly local (allow "localhost", "127.0.0.1", "[::1]" and their ports);
call this validation during config load/initialization so non-local HTTP
endpoints are rejected and only localhost may use http. Ensure the validation
uses url.Parse, checks u.Scheme and normalized u.Hostname() and returns clear
errors for invalid/missing Host or insecure scheme.

In `@Taskfile.yml`:
- Around line 120-121: The health-check loop line "until curl -sf
http://localhost:7711/health > /dev/null; do sleep 0.5; done" can hang CI
indefinitely; replace it with a bounded wait that times out and fails the task
if Meilisearch doesn't become healthy (for example, implement a retry counter or
elapsed-time check and exit non-zero after a max wait like 30s/60 attempts).
Keep the subsequent test invocation "TEST_MEILISEARCH_URL=...
TEST_MEILISEARCH_KEY=... go test ./internal/data/search/ -v -count=1" unchanged;
ensure the bounded-wait returns success only when the curl succeeds and
otherwise prints a clear error and exits non-zero so the task fails fast.

---

Nitpick comments:
In `@backend/internal/sys/config/conf_search_test.go`:
- Line 30: The test in conf_search_test.go calls assert.Contains(t, string(out),
sentinel) but sentinel must be defined at package scope; declare const sentinel
= redactedValue in the package test file conf_redact_test.go (where other tests
share package config) so conf_search_test.go compiles, and ensure redactedValue
remains a stable, non-plausible marker to avoid matching real secrets.

In `@docs/src/content/docs/en/quick-start/configure/search.mdx`:
- Around line 42-43: Replace the example value for the
HBOX_SEARCH_MEILISEARCH_API_KEY env var so it shows a scoped/search-only key
(e.g., "your_scoped_search_key" or "scoped_search_key") instead of
"your_master_key" in all examples, and add a brief note nearby that the master
key should only be used for setup/admin operations; update every occurrence of
HBOX_SEARCH_MEILISEARCH_API_KEY in the file to use the scoped-key example and
keep master-key usage documented only in an admin/setup note.

In `@Taskfile.yml`:
- Line 118: The docker run command currently publishes Meilisearch on all
interfaces (-p 7711:7700); restrict it to loopback by changing the port mapping
to -p 127.0.0.1:7711:7700 in the docker run line (the entry starting with
"docker run -d --rm --name homebox-meili-test ... getmeili/meilisearch:v1.22")
so the container only binds to localhost for test runs.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@backend/internal/sys/config/conf.go`:
- Around line 100-125: The Validate() method of MeilisearchConf uses string
comparison on u.Hostname() to detect loopback addresses, but Go's url.Parse does
not normalize IPv6 addresses, causing full IPv6 notation like
http://[0:0:0:0:0:0:0:1]:7700 to bypass the loopback check. Replace the
string-based hostname check in the http case with a proper IP-based check by
parsing the hostname using net.ParseIP() and calling IsLoopback() on the
resulting net.IP object, which handles all IPv6 and IPv4 loopback
representations correctly.