Add project scaffolding and documentation

Add .env.example with configuration for database, Redis, security, SMTP, workers, and plugins. Add .gitignore for Python, Node.js, Next.js, Docker volumes, and IDE files. Add MIT License. Update README.md with feature overview, quick start guide, architecture description, plugin system documentation, security details, backup/restore instructions, and developer setup. Add Alembic configuration files and placeholder directories for API, web, worker, and plugin components

apps/api/tests/test_security.py

@@ -0,0 +1,29 @@
+from apps.api.src.security.password import hash_password, verify_password
+from apps.api.src.security.encryption import encrypt_value, decrypt_value, mask_secret
+from apps.api.src.security.ssrf import is_safe_url
+
+
+def test_password_hash():
+    pw = "super-secret-password"
+    hashed = hash_password(pw)
+    assert verify_password(pw, hashed)
+    assert not verify_password("wrong", hashed)
+
+
+def test_encryption():
+    value = "api-token-secret"
+    encrypted = encrypt_value(value)
+    decrypted = decrypt_value(encrypted)
+    assert decrypted == value
+
+
+def test_mask_secret():
+    assert mask_secret("1234567890", 4) == "******7890"
+
+
+def test_ssrf_protection():
+    assert not is_safe_url("http://localhost:8000")
+    assert not is_safe_url("http://127.0.0.1/admin")
+    assert not is_safe_url("http://169.254.169.254")
+    assert not is_safe_url("ftp://example.com")
+    assert is_safe_url("https://example.com/api")