feat: Update configuration files for storage path and spam protection settings

.env.example

@@ -6,6 +6,8 @@
 Server__Name=My EchoHub Server
 Server__Description=A self-hosted EchoHub chat server
 Server__PublicServer=false
+# Registration mode: open (default), invite (codes via /invite, Admin+), or closed.
+# Server__Registration=open
 # Hostnames advertised to the EchoHubSpace directory. Index per entry.
 # Server__PublicHosts__0=echohub.example.com
 # Server__PublicHosts__1=alias.example.com
@@ -13,6 +15,8 @@ Server__PublicServer=false
 # Server__Tags__0=community
 # Server__Tags__1=gaming
 # Server__Admins__0=adminUsername
+# Override where the EchoHubSpace claim token file is stored (defaults next to the DB).
+# Server__DirectoryClaimPath=
 
 # ── JWT ──────────────────────────────────────────────────────────────
 # Auto-generated on first run if left empty. Only set if you need a stable secret across containers.
@@ -27,9 +31,32 @@ Server__PublicServer=false
 
 # ── Storage ──────────────────────────────────────────────────────────
 # Defaults are set in the Dockerfile to use /app/data for persistence.
+# Storage__Path=
 # Storage__CleanupIntervalHours=1
 # Storage__RetentionDays=30
 
+# ── Uploads ──────────────────────────────────────────────────────────
+# Uploads__MaxFileSizeMB=100
+# Uploads__MaxImageSizeMB=10
+# Uploads__MaxAudioSizeMB=10
+# Uploads__MaxAvatarSizeMB=2
+# Uploads__MaxAttachmentsPerMessage=10
+
+# ── Spam protection ──────────────────────────────────────────────────
+# Per-user flood/duplicate limits with auto-mute escalation; Mods and above are exempt.
+# Spam__Enabled=true
+# Spam__MaxMessagesPerWindow=8
+# Spam__WindowSeconds=5
+# Spam__MaxDuplicateMessages=3
+# Spam__AutoMuteMinutes=5
+# Spam__ViolationThreshold=5
+# Spam__ViolationWindowMinutes=5
+# Only first-time channel joins count — keep this above your public channel count.
+# Spam__MaxJoinsPerWindow=25
+# Spam__JoinWindowSeconds=30
+# Spam__MaxChannelCreatesPerWindow=3
+# Spam__ChannelCreateWindowMinutes=10
+
 # ── IRC Gateway ──────────────────────────────────────────────────────
 Irc__Enabled=false
 # Irc__Port=6667
@@ -39,6 +66,12 @@ Irc__Enabled=false
 # Irc__TlsCertPassword=
 # Irc__ServerName=echohub
 # Irc__Motd=Welcome to EchoHub IRC Gateway!
+# Public base URL used to make attachment links absolute for IRC clients.
+# Irc__PublicBaseUrl=https://chat.example.com
+
+# ── CORS ─────────────────────────────────────────────────────────────
+# Leave unset to allow all origins. Index per entry to whitelist.
+# Cors__AllowedOrigins__0=https://chat.example.com
 
 # ── Logging ──────────────────────────────────────────────────────────
 # Serilog__MinimumLevel__Default=Information

src/EchoHub.Server/Services/FileCleanupService.cs

@@ -15,8 +15,10 @@ public sealed class FileCleanupService : BackgroundService
     {
         var intervalHours = _configuration.GetValue("Storage:CleanupIntervalHours", 1);
         var retentionDays = _configuration.GetValue("Storage:RetentionDays", 30);
-        var storagePath = _configuration["Storage:Path"]
+        var configuredPath = _configuration["Storage:Path"];
-            ?? Path.Combine(AppContext.BaseDirectory, "uploads");
+        var storagePath = !string.IsNullOrWhiteSpace(configuredPath)
+            ? configuredPath
+            : Path.Combine(AppContext.BaseDirectory, "uploads");
 
         _logger.LogInformation(
             "File cleanup service started — interval: {Hours}h, retention: {Days}d, path: {Path}",

src/EchoHub.Server/Services/FileStorageService.cs

@@ -6,8 +6,11 @@ public class FileStorageService
 
     public FileStorageService(IConfiguration configuration)
     {
-        _storagePath = configuration["Storage:Path"]
+        // Empty string (example config placeholder) means "unset", same as missing
-            ?? Path.Combine(AppContext.BaseDirectory, "uploads");
+        var configured = configuration["Storage:Path"];
+        _storagePath = !string.IsNullOrWhiteSpace(configured)
+            ? configured
+            : Path.Combine(AppContext.BaseDirectory, "uploads");
 
         if (!Directory.Exists(_storagePath))
         {

src/EchoHub.Server/appsettings.example.json

@@ -15,9 +15,11 @@
     "PublicHosts": [],
     "Tags": [],
     "Admins": [],
-    "Registration": "open"
+    "Registration": "open",
+    "DirectoryClaimPath": ""
   },
   "Storage": {
+    "Path": "",
     "CleanupIntervalHours": 1,
     "RetentionDays": 30
   },
@@ -53,7 +55,11 @@
     "TlsCertPath": "",
     "TlsCertPassword": "",
     "ServerName": "echohub",
-    "Motd": "Welcome to EchoHub IRC Gateway!"
+    "Motd": "Welcome to EchoHub IRC Gateway!",
+    "PublicBaseUrl": ""
+  },
+  "Cors": {
+    "AllowedOrigins": []
   },
   "Serilog": {
     "MinimumLevel": {