Solves the problem of managing users when running in Docker, where
connecting an external REPL to the containerized Datomic has always
failed. Uses docker exec + clojure.main against the uberjar classpath
to run Datomic peer operations inside the container.

New files:
- docker-user.sh: Shell wrapper that finds the orcpub container,
  waits for Datomic readiness, and runs commands
- docker/scripts/manage-user.clj: Clojure script supporting
  create (auto-verified), verify, check, and list operations

Also updates docker-setup.sh to prompt for passwords interactively
instead of silently generating them.

https://claude.ai/code/session_01KdeKniaCeDDV1UvnkTLQcb

Runs on PRs that touch Docker/deploy files. Tests the full flow:
docker-setup.sh --auto, docker compose up, then exercises all
docker-user.sh commands (create, check, list, verify, duplicate
rejection, nonexistent user). Also lints shell scripts with shellcheck.

https://claude.ai/code/session_01KdeKniaCeDDV1UvnkTLQcb

Tests that a user created via docker-user.sh can actually log in
through the app's POST /login endpoint and receive a JWT token.
Also verifies that wrong passwords are rejected with HTTP 401.

https://claude.ai/code/session_01KdeKniaCeDDV1UvnkTLQcb

- Remove unused ENV_EXAMPLE variable (SC2034)
- Quote expansions inside ${dir#...} parameter substitution (SC2295)

https://claude.ai/code/session_01KdeKniaCeDDV1UvnkTLQcb

- Add healthcheck to datomic service (nc -z localhost 4334)
- Add healthcheck to orcpub service (wget --spider localhost:8890)
- Use depends_on condition: service_healthy for proper startup ordering
- Replace JVM-per-iteration readiness loop in docker-user.sh with
  docker inspect health status polling (falls back to wget if no
  healthcheck is defined)
- Replace CI wait steps with health status polling instead of
  spawning a new JVM every second
- Fix CI HTTP tests to use nginx (port 443) since orcpub:8890
  is not exposed to the host
- Remove obsolete `version: '3'` from both compose files

https://claude.ai/code/session_01KdeKniaCeDDV1UvnkTLQcb

…eck SC2059

The datomic healthcheck used `nc -z localhost 4334` but netcat is not
available in the openjdk:8u242-jre base image, causing the container to
always report unhealthy. Replace with bash's built-in /dev/tcp which is
guaranteed available. Also increase start_period to 30s and retries to 20
to give the JVM transactor more time on CI runners.

Fix shellcheck SC2059 warnings in docker-setup.sh and docker-user.sh by
moving color variables out of printf format strings into %s arguments.

https://claude.ai/code/session_016YeAFxbw5tP5VPa95KGLWY

The previous healthcheck (bash -c 'echo > /dev/tcp/localhost/4334') fails
on the openjdk:8u242-jre base image because CMD-SHELL runs via /bin/sh
(dash) and /dev/tcp is a bash-only feature that may not be available in
slim Debian images. Replace with grep on /proc/net/tcp which checks the
kernel TCP listen table directly — requires only grep (always present)
and works on any Linux container.

Port 4334 decimal = 10EE hex, so we grep for ':10EE ' in /proc/net/tcp
with a fallback to /proc/net/tcp6 for IPv6 listeners.

Also restructure the CI workflow to start datomic independently first
(docker compose up -d --no-deps datomic) so the depends_on chain
doesn't block. This ensures we get container logs and health state
on failure instead of an opaque "dependency failed to start" error.

https://claude.ai/code/session_01KkQBjzJHkceYz36K79jWri

The Datomic peer connection creates non-daemon background threads
(heartbeats, connection pools) that keep the JVM alive indefinitely
after the script finishes its work. Error paths already called
System/exit 1, but success paths returned normally — leaving the
JVM (and docker exec) hanging forever in CI.

Add System/exit 0 after the CLI dispatch case to force clean shutdown.

https://claude.ai/code/session_01KkQBjzJHkceYz36K79jWri

Add `./docker-user.sh batch <file>` command that creates multiple users
from a text file in one JVM startup (~4s) instead of one per user.

File format: one user per line (username email password), with # comments
and blank lines skipped. Duplicates are logged as SKIP and don't count
as failures — only unexpected errors cause a non-zero exit.

Refactored create-user! → try-create-user! to return result maps
({:ok true}, {:duplicate "reason"}, {:error "msg"}) instead of calling
System/exit, so batch can continue past duplicates while single create
still exits on any conflict.

Added CI test that batch-creates 2 new users + 1 duplicate and verifies
the summary counts (2 created, 1 skipped, 0 failed).

https://claude.ai/code/session_01KkQBjzJHkceYz36K79jWri