chore: initial project setup with backend, frontend, Android app, and CI/CD

Add complete NexaMFA push MFA system with:
- FastAPI backend with PostgreSQL, Redis, OIDC provider, and Prometheus metrics
- React TypeScript admin console
- Android Kotlin/Jetpack Compose app with biometric authentication
- Docker Compose deployment configuration
- Gitea CI workflow for backend, frontend, and Android builds
- Environment configuration template with security settings
- Documentation for security model, deployment

backend/tests/test_crypto.py

@@ -0,0 +1,22 @@
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
+from cryptography.hazmat.primitives.hashes import SHA256
+
+from app.core.security import b64url, canonical_json, verify_signature
+
+
+def test_verify_es256_signature_der_and_raw():
+    private_key = ec.generate_private_key(ec.SECP256R1())
+    public_pem = private_key.public_key().public_bytes(
+        serialization.Encoding.PEM,
+        serialization.PublicFormat.SubjectPublicKeyInfo,
+    ).decode("utf-8")
+    payload = {"challenge_id": "abc", "nonce": "n", "user_id": "u"}
+    der_sig = private_key.sign(canonical_json(payload), ec.ECDSA(SHA256()))
+    r, s = decode_dss_signature(der_sig)
+    raw_sig = r.to_bytes(32, "big") + s.to_bytes(32, "big")
+
+    assert verify_signature(public_pem, payload, b64url(der_sig))
+    assert verify_signature(public_pem, payload, b64url(raw_sig))
+    assert not verify_signature(public_pem, payload | {"nonce": "changed"}, b64url(der_sig))