Initial scaffold: FastAPI backend + Vue 3 frontend + Docker setup

Backend: config/db/security/logging core, SQLAlchemy models (Server,
Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh,
cau, audit, job_runner), REST API (auth, servers, updates, audit),
Socket.io WebSocket layer.
Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers,
Updates, Audit, Login), axios + socket.io-client, nginx prod config.

.env.example

@@ -0,0 +1,85 @@
+# Insight Updater - Environment Template
+# Copy to .env and fill in secrets
+
+# =============================================================================
+# CORE APPLICATION
+# =============================================================================
+APP_ENV=development
+SECRET_KEY=change-me-min-32-characters-random
+ENCRYPTION_KEY=change-me-32-bytes-base64-encoded
+JWT_ALGORITHM=RS256
+JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
+JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
+JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
+JWT_REFRESH_TOKEN_EXPIRE_DAYS=7
+
+# =============================================================================
+# DATABASE
+# =============================================================================
+# Development: SQLite (file-based, zero config)
+DATABASE_URL=sqlite+aiosqlite:///./data/app.db
+
+# Production: PostgreSQL (uncomment and configure)
+# DATABASE_URL=postgresql+asyncpg://updater:secure-password@db:5432/insight_updater
+
+# =============================================================================
+# REDIS (for Socket.io pub/sub, caching, rate limiting)
+# =============================================================================
+REDIS_URL=redis://redis:6379/0
+
+# =============================================================================
+# WINRM CONFIGURATION
+# =============================================================================
+WINRM_TRANSPORT=ntlm          # ntlm | kerberos | credssp
+WINRM_CERT_VALIDATION=ignore  # ignore | validate
+WINRM_OPERATION_TIMEOUT=60
+WINRM_READ_TIMEOUT=120
+WINRM_KERBEROS_DELEGATION=true
+
+# =============================================================================
+# SSH CONFIGURATION
+# =============================================================================
+SSH_TIMEOUT=30
+SSH_KEY_PATH=/app/keys/ssh_host_key  # optional host key for SSH server
+
+# =============================================================================
+# LDAP / ACTIVE DIRECTORY (STUB - prepared for future implementation)
+# =============================================================================
+LDAP_ENABLED=false
+LDAP_URI=ldaps://dc.insight.local:636
+LDAP_BIND_DN=CN=svc_updater,OU=Services,DC=insight,DC=local
+LDAP_BIND_PASSWORD=
+LDAP_USER_SEARCH_BASE=OU=Users,DC=insight,DC=local
+LDAP_USER_FILTER=(sAMAccountName={username})
+LDAP_GROUP_SEARCH_BASE=OU=Groups,DC=insight,DC=local
+LDAP_GROUP_FILTER=(member={user_dn})
+LDAP_CA_CERT_PATH=/app/certs/ldap-ca.pem
+
+# =============================================================================
+# FRONTEND (injected at build time via Vite)
+# =============================================================================
+VITE_API_URL=http://localhost:8000
+VITE_WS_URL=ws://localhost:8000
+VITE_APP_TITLE=Insight Updater
+
+# =============================================================================
+# LOGGING
+# =============================================================================
+LOG_LEVEL=INFO
+LOG_FORMAT=json  # json | console
+
+# =============================================================================
+# DOCKER / DEPLOYMENT
+# =============================================================================
+COMPOSE_PROJECT_NAME=insight-updater
+TRAEFIK_NETWORK=traefik-public
+DOMAIN=updater.insight-it.de
+
+# =============================================================================
+# EXTERNAL SERVICES
+# =============================================================================
+# Vaultwarden (for CI/CD secrets)
+VAULTWARDEN_URL=https://p.hartmannsche.cloud
+# Gitea
+GITEA_URL=https://gitea.insight-it.de
+GITEA_REPO=b0rbor4d/insight-updater