Split into a FastAPI backend and a React frontend, add case state and SSO

The single-file stdlib server became the limit: no way to track what had been
done about an alert, no accounts, and a UI that had to be hand-rolled in
template strings. This restructures it into something deployable.

Backend (FastAPI)
- app/ holds config, database, auth, delivery and the routers; triagelib keeps
  the triage engine unchanged, so the validated screening and runbook logic is
  untouched.
- Cases persist per alert fingerprint with a status workflow (investigating,
  customer contacted, escalated to Infra, waiting, remediated, resolved, won't
  fix, false positive), an assignee, notes and an append-only history. An alert
  that stops and re-fires lands back on the same case and counts as a reopen.
- Suppression rules move from a JSON file into the database.

Auth
- Signed session cookies over PBKDF2 local accounts, plus an OIDC flow ready for
  Authentik: users are created on first login and admin follows a group claim.
  Local login can be switched off entirely once SSO is live.

Zendesk and Jira
- Delivery is now implemented, behind three gates: the integration must be
  configured, its feature flag on, and CX_FEATURE_SEND_ENABLED on. A demo
  instance leaves the last off and cannot mail anyone. Both search before
  creating, so re-diagnosing an alert updates one ticket rather than opening
  several, and a rolling daily cap stops a loop mailing everybody.

Deployment
- Multi-stage Dockerfile builds the bundle and serves it from the API origin.
- docker-compose for local and single-host use; Gitea Actions runs the tests,
  builds the image and renders deploy/k8s with envsubst.

Two fixes found while testing: assigning a case returned a null assignee, and
add_event could leave an already-loaded history collection stale.

Known gap: the engine reaches OpenStack via `docker exec <region>-osc`, which
does not work in a pod without the CX-Tools containers alongside it.
docs/DEPLOYMENT.md sets out the three ways to close that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/k8s/00-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ${NAMESPACE}

deploy/k8s/10-config.yaml

@@ -0,0 +1,30 @@
+# Non-secret configuration. Secrets live in the `cx-triage` Secret, created by
+# the pipeline from the repository secret store.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cx-triage-config
+  namespace: ${NAMESPACE}
+data:
+  CX_APP_NAME: "CX Triage"
+  CX_BASE_URL: "${BASE_URL}"
+  CX_SESSION_HOURS: "12"
+  CX_STATIC_DIR: "/app/static"
+
+  CX_PROMETHEUS_BASE: "${PROMETHEUS_BASE}"
+
+  CX_AUTH_LOCAL_ENABLED: "false"
+  CX_OIDC_ENABLED: "${OIDC_ENABLED}"
+  CX_OIDC_ISSUER: "${OIDC_ISSUER}"
+  CX_OIDC_SCOPES: "openid email profile"
+  CX_OIDC_ADMIN_GROUP: "${OIDC_ADMIN_GROUP}"
+  CX_OIDC_GROUPS_CLAIM: "groups"
+
+  CX_FEATURE_SEND_ENABLED: "${FEATURE_SEND_ENABLED}"
+  CX_FEATURE_ZENDESK: "${FEATURE_ZENDESK}"
+  CX_FEATURE_JIRA: "${FEATURE_JIRA}"
+  CX_FEATURE_LINKAGE_SCAN: "${FEATURE_LINKAGE_SCAN}"
+  CX_SEND_DAILY_CAP: "${SEND_DAILY_CAP}"
+
+  CX_JIRA_PROJECT: "${JIRA_PROJECT}"
+  CX_JIRA_ISSUE_TYPE: "Task"

deploy/k8s/20-deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cx-triage
+  namespace: ${NAMESPACE}
+  labels: { app: cx-triage }
+spec:
+  replicas: ${REPLICAS}
+  strategy: { type: RollingUpdate }
+  selector:
+    matchLabels: { app: cx-triage }
+  template:
+    metadata:
+      labels: { app: cx-triage }
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        fsGroup: 10001
+      containers:
+        - name: app
+          image: ${IMAGE_REF}
+          imagePullPolicy: IfNotPresent
+          ports: [{ containerPort: 8080, name: http }]
+          envFrom:
+            - configMapRef: { name: cx-triage-config }
+            - secretRef: { name: cx-triage }
+          readinessProbe:
+            httpGet: { path: /api/health, port: http }
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: { path: /api/health, port: http }
+            # Startup warms a week of alert history, so allow a slow first start.
+            initialDelaySeconds: 60
+            periodSeconds: 30
+          resources:
+            requests: { cpu: 100m, memory: 256Mi }
+            limits:   { cpu: "1",  memory: 1Gi }
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: { drop: ["ALL"] }
+          volumeMounts:
+            - { name: tmp,  mountPath: /tmp }
+            - { name: data, mountPath: /data }
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: data
+          emptyDir: {}   # state lives in Postgres; this is scratch only

deploy/k8s/30-service.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: cx-triage
+  namespace: ${NAMESPACE}
+spec:
+  selector: { app: cx-triage }
+  ports:
+    - { name: http, port: 80, targetPort: http }

deploy/k8s/40-ingress.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cx-triage
+  namespace: ${NAMESPACE}
+  annotations:
+    cert-manager.io/cluster-issuer: "${TLS_ISSUER}"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+spec:
+  ingressClassName: ${INGRESS_CLASS}
+  tls:
+    - hosts: ["${DOMAIN}"]
+      secretName: cx-triage-tls
+  rules:
+    - host: ${DOMAIN}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: cx-triage
+                port: { name: http }