Backend su file SQLite locale: DB_URL, PRAGMA FK/WAL, UPLOAD_DIR assoluto (TieMeasureFlow#77)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/backend/config.py

@@ -27,6 +27,10 @@ class Settings(BaseSettings):
     db_name: str = "tiemeasureflow"
     db_user: str = "tmflow"
     db_password: str = _DEFAULT_DB_PASSWORD
+    # Full SQLAlchemy async URL (env DB_URL). When set it wins over the
+    # DB_HOST/DB_PORT/DB_NAME/DB_USER/DB_PASSWORD parts. Used by the Windows
+    # package: sqlite+aiosqlite:///C:/ProgramData/.../tmf.db (forward slashes).
+    db_url: str | None = None
 
     # Presentation time zone (DB is UTC, #42)
     display_timezone: str = "Europe/Rome"
@@ -78,7 +82,9 @@ class Settings(BaseSettings):
 
     @property
     def database_url(self) -> str:
-        """Async MySQL connection string."""
+        """Async connection string: DB_URL if set, else the MySQL one."""
+        if self.db_url:
+            return self.db_url
         return (
             f"mysql+asyncmy://{self.db_user}:{self.db_password}"
             f"@{self.db_host}:{self.db_port}/{self.db_name}"
@@ -97,7 +103,12 @@ class Settings(BaseSettings):
         (mounted as a Docker volume), not inside the backend tree.
         """
         # Path(__file__) = src/backend/config.py → parents[2] = project root
-        return Path(__file__).resolve().parents[2] / self.upload_dir
+        # UPLOAD_DIR may be absolute (Windows package: C:/ProgramData/...):
+        # in that case it is used as is instead of being joined to the root.
+        configured = Path(self.upload_dir)
+        if configured.is_absolute():
+            return configured
+        return Path(__file__).resolve().parents[2] / configured
 
     # Always resolve .env against the project root regardless of cwd
     # (pydantic-settings would otherwise treat the path as cwd-relative).
@@ -122,6 +133,10 @@ class Settings(BaseSettings):
                 "SERVER_SECRET_KEY is still the committed default value; "
                 "set it before running with APP_ENV=" + self.app_env
             )
+        # A SQLite file has no DB password: the default-password guard only
+        # makes sense for the MySQL connection built from the DB_* parts.
+        if self.db_url and self.db_url.startswith("sqlite"):
+            return self
         if self.db_password == _DEFAULT_DB_PASSWORD:
             raise RuntimeError(
                 "DB_PASSWORD is still the committed default value; "