Close the adversarial review round: auth hardening, data fidelity against the platform context, backend grants and docker coherence

.project/concepts/data-layer/cookbook_local-activitypods-platform.md

@@ -9,7 +9,7 @@ Platform checkout: `/home/sylvain/projects/activitypods/activitypods` (never mod
 
 ## Ports
 
-fuseki 3030 (admin/admin), mailcatcher 1080, redis 6379, backend 3000, frontend 5000, arena 4567, tripleadmin 3033.
+pod provider 3000 (OpenID + `/auth` signup/login), Festipod backend 3003, Festipod app 5000, fuseki 3030 (admin/admin), mailcatcher 1080, redis 6390, arena 4567, tripleadmin 3033.
 
 ## Bring up
 
@@ -17,6 +17,7 @@ fuseki 3030 (admin/admin), mailcatcher 1080, redis 6379, backend 3000, frontend
 2. Install once: `cd backend && COREPACK_ENABLE_AUTO_PIN=0 corepack yarn install --frozen-lockfile`, same in `frontend/`. Keep `COREPACK_ENABLE_AUTO_PIN=0`: corepack auto-pin rewrites `packageManager` in package.json. Note: the pod-provider README says `yarn start` for the frontend; only the `dev` script exists — use `BROWSER=none corepack yarn dev`.
 3. Backend: `cd backend && corepack yarn start`. Wait for "ServiceBroker with ... service(s) started successfully" (~11 s).
 4. Frontend: `cd frontend && BROWSER=none corepack yarn dev`. Verify: `GET http://localhost:5000/` → 200 and `GET http://localhost:3000/.well-known/config.js` → 200.
+5. Festipod stack (this repo root): `cp backend/.env.example backend/.env` before `docker compose up`. The compose reads `backend/.env` as an optional `env_file`; on a fresh clone the file is gitignored and absent, so this copy is what feeds the backend its ActivityPods settings. With the coherent layout the app is served on :5000 and the Festipod backend on :3003.
 
 ## Account and resource flow (all VERIFIED 2026-10-09)