Initial scaffold: FastAPI backend + Vue 3 frontend + Docker setup

Backend: config/db/security/logging core, SQLAlchemy models (Server,
Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh,
cau, audit, job_runner), REST API (auth, servers, updates, audit),
Socket.io WebSocket layer.
Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers,
Updates, Audit, Login), axios + socket.io-client, nginx prod config.

backend/app/core/config.py

@@ -0,0 +1,68 @@
+"""Application configuration via pydantic-settings.
+
+All values are read from environment variables / .env file.
+See .env.example for the full list.
+"""
+
+from functools import lru_cache
+
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    """Central application settings."""
+
+    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
+
+    # Core
+    app_env: str = "development"
+    app_name: str = "Insight Updater"
+    secret_key: str = "dev-secret-change-me-32-chars-min"
+    encryption_key: str = ""
+    log_level: str = "INFO"
+    log_format: str = "json"
+
+    # JWT
+    jwt_algorithm: str = "RS256"
+    jwt_private_key_path: str = "keys/private.pem"
+    jwt_public_key_path: str = "keys/public.pem"
+    jwt_access_token_expire_minutes: int = 30
+    jwt_refresh_token_expire_days: int = 7
+
+    # Database / Redis
+    database_url: str = "sqlite+aiosqlite:///./data/app.db"
+    redis_url: str = "redis://localhost:6379/0"
+
+    # WinRM
+    winrm_transport: str = "ntlm"
+    winrm_cert_validation: str = "ignore"
+    winrm_operation_timeout: int = 60
+    winrm_read_timeout: int = 120
+    winrm_kerberos_delegation: bool = True
+
+    # SSH
+    ssh_timeout: int = 30
+
+    # LDAP (stub)
+    ldap_enabled: bool = False
+    ldap_uri: str = ""
+    ldap_bind_dn: str = ""
+    ldap_bind_password: str = ""
+    ldap_user_search_base: str = ""
+    ldap_user_filter: str = "(sAMAccountName={username})"
+
+    # CORS
+    cors_origins: str = "http://localhost:3000,http://localhost:8000"
+
+    @property
+    def cors_origin_list(self) -> list[str]:
+        return [o.strip() for o in self.cors_origins.split(",") if o.strip()]
+
+    @property
+    def is_production(self) -> bool:
+        return self.app_env.lower() == "production"
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()