Split into a FastAPI backend and a React frontend, add case state and SSO

The single-file stdlib server became the limit: no way to track what had been
done about an alert, no accounts, and a UI that had to be hand-rolled in
template strings. This restructures it into something deployable.

Backend (FastAPI)
- app/ holds config, database, auth, delivery and the routers; triagelib keeps
  the triage engine unchanged, so the validated screening and runbook logic is
  untouched.
- Cases persist per alert fingerprint with a status workflow (investigating,
  customer contacted, escalated to Infra, waiting, remediated, resolved, won't
  fix, false positive), an assignee, notes and an append-only history. An alert
  that stops and re-fires lands back on the same case and counts as a reopen.
- Suppression rules move from a JSON file into the database.

Auth
- Signed session cookies over PBKDF2 local accounts, plus an OIDC flow ready for
  Authentik: users are created on first login and admin follows a group claim.
  Local login can be switched off entirely once SSO is live.

Zendesk and Jira
- Delivery is now implemented, behind three gates: the integration must be
  configured, its feature flag on, and CX_FEATURE_SEND_ENABLED on. A demo
  instance leaves the last off and cannot mail anyone. Both search before
  creating, so re-diagnosing an alert updates one ticket rather than opening
  several, and a rolling daily cap stops a loop mailing everybody.

Deployment
- Multi-stage Dockerfile builds the bundle and serves it from the API origin.
- docker-compose for local and single-host use; Gitea Actions runs the tests,
  builds the image and renders deploy/k8s with envsubst.

Two fixes found while testing: assigning a case returned a null assignee, and
add_event could leave an already-loaded history collection stale.

Known gap: the engine reaches OpenStack via `docker exec <region>-osc`, which
does not work in a pod without the CX-Tools containers alongside it.
docs/DEPLOYMENT.md sets out the three ways to close that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/routers/actions_router.py

@@ -0,0 +1,77 @@
+"""Outbound actions: contact the customer, escalate to Infrastructure."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+
+from ..auth import current_user
+from ..config import get_settings
+from ..db import get_db
+from ..delivery import DeliveryError, create_jira, send_zendesk, sends_today
+from ..models import Case, User
+
+router = APIRouter(prefix="/api/actions", tags=["actions"])
+settings = get_settings()
+
+
+class ZendeskBody(BaseModel):
+    fingerprint: str
+    to: str
+    subject: str
+    body: str
+    priority: str = "normal"
+    tags: list[str] = []
+    public: bool | None = None
+
+
+class JiraBody(BaseModel):
+    fingerprint: str
+    summary: str
+    description: str
+    project: str = ""
+    issue_type: str = ""
+    labels: list[str] = []
+
+
+def _case(db: Session, fingerprint: str) -> Case:
+    found = db.query(Case).filter(Case.fingerprint == fingerprint).one_or_none()
+    if not found:
+        raise HTTPException(status.HTTP_404_NOT_FOUND,
+                            "Open the case first - nothing is tracked for that alert yet.")
+    return found
+
+
+@router.get("/status")
+def action_status(db: Session = Depends(get_db), user: User = Depends(current_user)):
+    return {
+        "zendesk_ready": settings.zendesk_ready,
+        "jira_ready": settings.jira_ready,
+        "send_enabled": settings.feature_send_enabled,
+        "sends_today": sends_today(db),
+        "daily_cap": settings.send_daily_cap,
+    }
+
+
+@router.post("/zendesk")
+async def zendesk(body: ZendeskBody, db: Session = Depends(get_db),
+                  user: User = Depends(current_user)):
+    case = _case(db, body.fingerprint)
+    try:
+        return await send_zendesk(db, case, user, to=body.to, subject=body.subject,
+                                  body=body.body, priority=body.priority,
+                                  tags=body.tags or None, public=body.public)
+    except DeliveryError as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc
+
+
+@router.post("/jira")
+async def jira(body: JiraBody, db: Session = Depends(get_db),
+               user: User = Depends(current_user)):
+    case = _case(db, body.fingerprint)
+    try:
+        return await create_jira(db, case, user, summary=body.summary,
+                                 description=body.description, project=body.project,
+                                 issue_type=body.issue_type, labels=body.labels or None)
+    except DeliveryError as exc:
+        raise HTTPException(status.HTTP_400_BAD_REQUEST, str(exc)) from exc