chore: initial project setup with backend, frontend, Android app, and CI/CD

Add complete NexaMFA push MFA system with:
- FastAPI backend with PostgreSQL, Redis, OIDC provider, and Prometheus metrics
- React TypeScript admin console
- Android Kotlin/Jetpack Compose app with biometric authentication
- Docker Compose deployment configuration
- Gitea CI workflow for backend, frontend, and Android builds
- Environment configuration template with security settings
- Documentation for security model, deployment

docs/gitea-actions.md

@@ -0,0 +1,30 @@
+# Gitea Actions CI/CD
+
+The workflow at `.gitea/workflows/ci.yml` builds and tests:
+
+- Backend Python tests
+- Backend Docker image
+- Frontend TypeScript build
+- Frontend Docker image
+- Android debug APK
+- Android release APK
+- Android release AAB
+
+## Required Secrets
+
+Set these repository secrets in Gitea for signed Android release builds:
+
+- `ANDROID_KEYSTORE_BASE64`
+- `ANDROID_KEYSTORE_PASSWORD`
+- `ANDROID_KEY_ALIAS`
+- `ANDROID_KEY_PASSWORD`
+- `GOOGLE_SERVICES_JSON_BASE64`
+
+Create base64 values with:
+
+```bash
+base64 -w0 release.keystore
+base64 -w0 google-services.json
+```
+
+The Gradle Google Services plugin is applied only when `android/app/google-services.json` exists. The debug APK and unit tests can build without Firebase configuration, but real push delivery requires it.