chore: initial project setup with backend, frontend, Android app, and CI/CD

Add complete NexaMFA push MFA system with:
- FastAPI backend with PostgreSQL, Redis, OIDC provider, and Prometheus metrics
- React TypeScript admin console
- Android Kotlin/Jetpack Compose app with biometric authentication
- Docker Compose deployment configuration
- Gitea CI workflow for backend, frontend, and Android builds
- Environment configuration template with security settings
- Documentation for security model, deployment

.env.example

@@ -0,0 +1,30 @@
+APP_NAME=NexaMFA
+ENVIRONMENT=prod
+PUBLIC_BASE_URL=https://mfa.example.com
+CORS_ORIGINS=https://mfa-admin.example.com
+
+POSTGRES_DB=nexamfa
+POSTGRES_USER=nexamfa
+POSTGRES_PASSWORD=replace-with-a-long-random-password
+DATABASE_URL=postgresql+asyncpg://nexamfa:replace-with-a-long-random-password@postgres:5432/nexamfa
+REDIS_URL=redis://redis:6379/0
+
+ADMIN_TOKEN=replace-with-a-long-random-admin-token
+
+OIDC_ISSUER=https://mfa.example.com
+OIDC_CLIENT_ID=authentik
+OIDC_CLIENT_SECRET=replace-with-a-long-random-oidc-secret
+OIDC_REDIRECT_URIS=https://authentik.example.com/application/o/nexamfa/callback/
+# Generate a persistent RSA key and paste the PEM as a single-line escaped value or Docker secret.
+# OIDC_SIGNING_KEY_PEM=
+
+CHALLENGE_TTL_SECONDS=60
+ENROLLMENT_TTL_SECONDS=600
+ACCESS_TOKEN_TTL_SECONDS=300
+AUTH_CODE_TTL_SECONDS=120
+RATE_LIMIT_DEFAULT=120/minute
+RATE_LIMIT_APPROVE=12/minute
+
+FCM_PROJECT_ID=your-firebase-project-id
+# Store the Firebase service account JSON as a secret in production.
+FCM_SERVICE_ACCOUNT_JSON=