Initial scaffold: FastAPI backend + Vue 3 frontend + Docker setup

Backend: config/db/security/logging core, SQLAlchemy models (Server,
Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh,
cau, audit, job_runner), REST API (auth, servers, updates, audit),
Socket.io WebSocket layer.
Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers,
Updates, Audit, Login), axios + socket.io-client, nginx prod config.

backend/app/main.py

@@ -0,0 +1,108 @@
+"""FastAPI application entrypoint.
+
+Mounts:
+  - REST API under /api
+  - Socket.io under /socket.io (path) -> frontend connects to ws://host/socket.io
+  - /health liveness probe
+"""
+
+from contextlib import asynccontextmanager
+
+import socketio
+from fastapi import FastAPI, Request
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
+
+from app.api import api_router
+from app.core.config import get_settings
+from app.core.database import init_db
+from app.core.exceptions import AppError
+from app.core.logging import get_logger, setup_logging
+from app.websocket import sio
+
+settings = get_settings()
+logger = get_logger(__name__)
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):  # type: ignore[no-untyped-def]
+    setup_logging()
+    logger.info("app.starting", env=settings.app_env)
+
+    await init_db()
+    await _seed_default_admin()
+
+    # Attach Redis manager for Socket.io pub/sub (optional in dev)
+    try:
+        from socketio import AsyncRedisManager
+
+        sio.manager = AsyncRedisManager(settings.redis_url)
+        logger.info("ws.redis_manager_attached", url=settings.redis_url)
+    except Exception as exc:  # noqa: BLE001 - Redis optional for scaffold
+        logger.warning("ws.redis_unavailable", error=str(exc))
+
+    yield
+
+    logger.info("app.stopping")
+
+
+async def _seed_default_admin() -> None:
+    """Create the initial admin user if no users exist (dev bootstrap).
+
+    Password comes from ADMIN_INITIAL_PASSWORD env, default 'admin' (dev only).
+    """
+    import os
+
+    from sqlalchemy import func, select
+
+    from app.core.database import async_session_factory
+    from app.core.security import hash_password
+    from app.models.user import User
+
+    async with async_session_factory() as db:
+        count = await db.scalar(select(func.count(User.id)))
+        if count and count > 0:
+            return
+        password = os.environ.get("ADMIN_INITIAL_PASSWORD", "admin")
+        db.add(
+            User(
+                username="admin",
+                email=None,
+                full_name="Administrator",
+                password_hash=hash_password(password),
+                is_admin=True,
+            )
+        )
+        await db.commit()
+        logger.info("app.default_admin_created", username="admin")
+
+
+fastapi_app = FastAPI(
+    title=settings.app_name,
+    version="0.1.0",
+    lifespan=lifespan,
+)
+
+fastapi_app.add_middleware(
+    CORSMiddleware,
+    allow_origins=settings.cors_origin_list,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+
+@fastapi_app.exception_handler(AppError)
+async def app_error_handler(request: Request, exc: AppError) -> JSONResponse:  # noqa: ARG001
+    return JSONResponse(status_code=exc.status_code, content={"detail": exc.detail})
+
+
+@fastapi_app.get("/health")
+async def health() -> dict:
+    return {"status": "ok", "env": settings.app_env, "version": "0.1.0"}
+
+
+fastapi_app.include_router(api_router)
+
+# Combined ASGI app: FastAPI + Socket.io
+app = socketio.ASGIApp(sio, other_asgi_app=fastapi_app, socketio_path="socket.io")