feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens

- docker-compose with Postgres 16 + slim Python API image
- FastAPI app with session middleware, health endpoint, static login page
- Google OAuth (Authlib) with email invite-list whitelist; admin role support
- User + OAuthToken models; refresh tokens encrypted at rest (Fernet)
- Alembic migrations, run automatically on container startup
- Postgres backup/restore scripts for portability between machines

backend/app/config.py

@@ -0,0 +1,36 @@
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env", extra="ignore")
+
+    app_name: str = "Subfeed"
+
+    database_url: str = "postgresql+psycopg://subfeed:subfeed@db:5432/subfeed"
+
+    # Session cookie signing key.
+    secret_key: str = "change-me-session-key"
+    # Fernet key (urlsafe base64, 32 bytes) for encrypting stored refresh tokens.
+    token_encryption_key: str = ""
+
+    google_client_id: str = ""
+    google_client_secret: str = ""
+    oauth_redirect_url: str = "http://localhost:8080/auth/callback"
+
+    # Comma-separated invite list / admin list of Google account emails.
+    allowed_emails: str = ""
+    admin_emails: str = ""
+
+    # Origin of a separately served frontend dev server (enables CORS). Empty in production.
+    frontend_origin: str = ""
+
+    @property
+    def allowed_email_set(self) -> set[str]:
+        return {e.strip().lower() for e in self.allowed_emails.split(",") if e.strip()}
+
+    @property
+    def admin_email_set(self) -> set[str]:
+        return {e.strip().lower() for e in self.admin_emails.split(",") if e.strip()}
+
+
+settings = Settings()