chore: initial project setup with backend, frontend, Android app, and CI/CD

Add complete NexaMFA push MFA system with:
- FastAPI backend with PostgreSQL, Redis, OIDC provider, and Prometheus metrics
- React TypeScript admin console
- Android Kotlin/Jetpack Compose app with biometric authentication
- Docker Compose deployment configuration
- Gitea CI workflow for backend, frontend, and Android builds
- Environment configuration template with security settings
- Documentation for security model, deployment

backend/app/core/config.py

@@ -0,0 +1,49 @@
+from functools import lru_cache
+from typing import Literal
+
+from pydantic import AnyHttpUrl, Field, computed_field
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
+
+    app_name: str = "NexaMFA"
+    environment: Literal["dev", "test", "prod"] = "dev"
+    public_base_url: AnyHttpUrl = "https://mfa.example.com"
+    cors_origins: str = "http://localhost:5173"
+
+    database_url: str = "postgresql+asyncpg://nexamfa:nexamfa@postgres:5432/nexamfa"
+    redis_url: str = "redis://redis:6379/0"
+
+    admin_token: str = Field(default="change-me-admin-token")
+    oidc_issuer: str = "https://mfa.example.com"
+    oidc_client_id: str = "authentik"
+    oidc_client_secret: str = "change-me-oidc-secret"
+    oidc_redirect_uris: str = "https://authentik.example.com/application/o/nexamfa/callback/"
+    oidc_signing_key_pem: str | None = None
+
+    challenge_ttl_seconds: int = 60
+    enrollment_ttl_seconds: int = 600
+    access_token_ttl_seconds: int = 300
+    auth_code_ttl_seconds: int = 120
+    rate_limit_default: str = "120/minute"
+    rate_limit_approve: str = "12/minute"
+
+    fcm_project_id: str | None = None
+    fcm_service_account_json: str | None = None
+
+    @computed_field
+    @property
+    def cors_origin_list(self) -> list[str]:
+        return [origin.strip() for origin in self.cors_origins.split(",") if origin.strip()]
+
+    @computed_field
+    @property
+    def oidc_redirect_uri_list(self) -> list[str]:
+        return [uri.strip() for uri in self.oidc_redirect_uris.split(",") if uri.strip()]
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()