Split into a FastAPI backend and a React frontend, add case state and SSO

The single-file stdlib server became the limit: no way to track what had been
done about an alert, no accounts, and a UI that had to be hand-rolled in
template strings. This restructures it into something deployable.

Backend (FastAPI)
- app/ holds config, database, auth, delivery and the routers; triagelib keeps
  the triage engine unchanged, so the validated screening and runbook logic is
  untouched.
- Cases persist per alert fingerprint with a status workflow (investigating,
  customer contacted, escalated to Infra, waiting, remediated, resolved, won't
  fix, false positive), an assignee, notes and an append-only history. An alert
  that stops and re-fires lands back on the same case and counts as a reopen.
- Suppression rules move from a JSON file into the database.

Auth
- Signed session cookies over PBKDF2 local accounts, plus an OIDC flow ready for
  Authentik: users are created on first login and admin follows a group claim.
  Local login can be switched off entirely once SSO is live.

Zendesk and Jira
- Delivery is now implemented, behind three gates: the integration must be
  configured, its feature flag on, and CX_FEATURE_SEND_ENABLED on. A demo
  instance leaves the last off and cannot mail anyone. Both search before
  creating, so re-diagnosing an alert updates one ticket rather than opening
  several, and a rolling daily cap stops a loop mailing everybody.

Deployment
- Multi-stage Dockerfile builds the bundle and serves it from the API origin.
- docker-compose for local and single-host use; Gitea Actions runs the tests,
  builds the image and renders deploy/k8s with envsubst.

Two fixes found while testing: assigning a case returned a null assignee, and
add_event could leave an already-loaded history collection stale.

Known gap: the engine reaches OpenStack via `docker exec <region>-osc`, which
does not work in a pod without the CX-Tools containers alongside it.
docs/DEPLOYMENT.md sets out the three ways to close that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/config.py

@@ -0,0 +1,101 @@
+"""Environment-driven configuration.
+
+Everything deployment-specific comes from the environment so the same image runs
+locally under compose and in Kubernetes with only a ConfigMap/Secret difference.
+"""
+from __future__ import annotations
+
+import os
+from functools import lru_cache
+
+
+def _bool(name: str, default: bool = False) -> bool:
+    return str(os.environ.get(name, str(default))).strip().lower() in {"1", "true", "yes", "on"}
+
+
+def _int(name: str, default: int) -> int:
+    try:
+        return int(os.environ.get(name, default))
+    except (TypeError, ValueError):
+        return default
+
+
+class Settings:
+    # --- app ---------------------------------------------------------------
+    app_name = os.environ.get("CX_APP_NAME", "CX Triage")
+    base_url = os.environ.get("CX_BASE_URL", "http://localhost:8080")
+    secret_key = os.environ.get("CX_SECRET_KEY", "dev-only-change-me")
+    session_hours = _int("CX_SESSION_HOURS", 12)
+    static_dir = os.environ.get("CX_STATIC_DIR", "/app/static")
+
+    # --- database ----------------------------------------------------------
+    # sqlite for local/compose, postgres in the cluster.
+    database_url = os.environ.get("CX_DATABASE_URL", "sqlite:////data/cx-triage.db")
+
+    # --- data sources ------------------------------------------------------
+    prometheus_base = os.environ.get("CX_PROMETHEUS_BASE", "http://10.11.254.250:9090")
+    prometheus_relay = os.environ.get("CX_PROMETHEUS_RELAY", "")
+    cx_tools_path = os.environ.get("CX_TOOLS_PATH", "")
+
+    # --- auth --------------------------------------------------------------
+    # Local accounts are for development and for a cluster without SSO yet.
+    # When CX_OIDC_ENABLED is on, Authentik becomes the source of truth.
+    auth_local_enabled = _bool("CX_AUTH_LOCAL_ENABLED", True)
+    bootstrap_admin_email = os.environ.get("CX_BOOTSTRAP_ADMIN_EMAIL", "admin@localhost")
+    bootstrap_admin_password = os.environ.get("CX_BOOTSTRAP_ADMIN_PASSWORD", "")
+
+    oidc_enabled = _bool("CX_OIDC_ENABLED", False)
+    oidc_issuer = os.environ.get("CX_OIDC_ISSUER", "")            # e.g. https://sso/application/o/cx-triage/
+    oidc_client_id = os.environ.get("CX_OIDC_CLIENT_ID", "")
+    oidc_client_secret = os.environ.get("CX_OIDC_CLIENT_SECRET", "")
+    oidc_scopes = os.environ.get("CX_OIDC_SCOPES", "openid email profile")
+    oidc_admin_group = os.environ.get("CX_OIDC_ADMIN_GROUP", "cx-triage-admins")
+    oidc_groups_claim = os.environ.get("CX_OIDC_GROUPS_CLAIM", "groups")
+
+    # --- feature flags -----------------------------------------------------
+    # Sending must be switched on deliberately; a demo instance cannot email.
+    feature_send_enabled = _bool("CX_FEATURE_SEND_ENABLED", False)
+    feature_zendesk = _bool("CX_FEATURE_ZENDESK", False)
+    feature_jira = _bool("CX_FEATURE_JIRA", False)
+    feature_linkage_scan = _bool("CX_FEATURE_LINKAGE_SCAN", True)
+    send_daily_cap = _int("CX_SEND_DAILY_CAP", 25)
+
+    # --- integrations ------------------------------------------------------
+    zendesk_subdomain = os.environ.get("CX_ZENDESK_SUBDOMAIN", "")
+    zendesk_email = os.environ.get("CX_ZENDESK_EMAIL", "")
+    zendesk_token = os.environ.get("CX_ZENDESK_TOKEN", "")
+    zendesk_default_public = _bool("CX_ZENDESK_PUBLIC_REPLY", True)
+
+    jira_base = os.environ.get("CX_JIRA_BASE", "")
+    jira_email = os.environ.get("CX_JIRA_EMAIL", "")
+    jira_token = os.environ.get("CX_JIRA_TOKEN", "")
+    jira_project = os.environ.get("CX_JIRA_PROJECT", "INFRA")
+    jira_issue_type = os.environ.get("CX_JIRA_ISSUE_TYPE", "Task")
+
+    @property
+    def zendesk_ready(self) -> bool:
+        return bool(self.feature_zendesk and self.zendesk_subdomain
+                    and self.zendesk_email and self.zendesk_token)
+
+    @property
+    def jira_ready(self) -> bool:
+        return bool(self.feature_jira and self.jira_base and self.jira_email
+                    and self.jira_token and self.jira_project)
+
+    def public_flags(self) -> dict:
+        """What the frontend is allowed to know - never secrets."""
+        return {
+            "app_name": self.app_name,
+            "oidc_enabled": self.oidc_enabled,
+            "local_login": self.auth_local_enabled,
+            "zendesk_ready": self.zendesk_ready,
+            "jira_ready": self.jira_ready,
+            "send_enabled": self.feature_send_enabled,
+            "linkage_scan": self.feature_linkage_scan,
+            "jira_project": self.jira_project if self.jira_ready else "",
+        }
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()