chore: initial project setup with backend, frontend, Android app, and CI/CD

Add complete NexaMFA push MFA system with:
- FastAPI backend with PostgreSQL, Redis, OIDC provider, and Prometheus metrics
- React TypeScript admin console
- Android Kotlin/Jetpack Compose app with biometric authentication
- Docker Compose deployment configuration
- Gitea CI workflow for backend, frontend, and Android builds
- Environment configuration template with security settings
- Documentation for security model, deployment

.gitea/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: NexaMFA CI
+
+on:
+  push:
+    branches: ["main", "master"]
+  pull_request:
+
+jobs:
+  backend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install backend dependencies
+        working-directory: backend
+        run: |
+          pip install --upgrade pip
+          pip install ".[test]"
+      - name: Run backend tests
+        working-directory: backend
+        env:
+          DATABASE_URL: sqlite+aiosqlite:///:memory:
+          ENVIRONMENT: test
+        run: pytest
+      - name: Build backend Docker image
+        run: docker build -t nexamfa-backend:${{ github.sha }} backend
+
+  frontend:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Build frontend
+        working-directory: frontend
+        run: |
+          npm install
+          npm run build
+      - name: Build frontend Docker image
+        run: docker build -t nexamfa-frontend:${{ github.sha }} frontend
+
+  android:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/cirruslabs/android-sdk:35
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare Firebase configuration
+        if: ${{ secrets.GOOGLE_SERVICES_JSON_BASE64 != '' }}
+        run: echo "${{ secrets.GOOGLE_SERVICES_JSON_BASE64 }}" | base64 -d > android/app/google-services.json
+      - name: Prepare release keystore
+        if: ${{ secrets.ANDROID_KEYSTORE_BASE64 != '' }}
+        run: |
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > android/release.keystore
+      - name: Build Android artifacts
+        working-directory: android
+        env:
+          ANDROID_KEYSTORE_PATH: ${{ github.workspace }}/android/release.keystore
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          gradle testDebugUnitTest assembleDebug assembleRelease bundleRelease
+      - name: Upload debug APK
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexamfa-debug-apk
+          path: android/app/build/outputs/apk/debug/*.apk
+      - name: Upload release APK
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexamfa-release-apk
+          path: android/app/build/outputs/apk/release/*.apk
+      - name: Upload release AAB
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexamfa-release-aab
+          path: android/app/build/outputs/bundle/release/*.aab