Split into a FastAPI backend and a React frontend, add case state and SSO

The single-file stdlib server became the limit: no way to track what had been
done about an alert, no accounts, and a UI that had to be hand-rolled in
template strings. This restructures it into something deployable.

Backend (FastAPI)
- app/ holds config, database, auth, delivery and the routers; triagelib keeps
  the triage engine unchanged, so the validated screening and runbook logic is
  untouched.
- Cases persist per alert fingerprint with a status workflow (investigating,
  customer contacted, escalated to Infra, waiting, remediated, resolved, won't
  fix, false positive), an assignee, notes and an append-only history. An alert
  that stops and re-fires lands back on the same case and counts as a reopen.
- Suppression rules move from a JSON file into the database.

Auth
- Signed session cookies over PBKDF2 local accounts, plus an OIDC flow ready for
  Authentik: users are created on first login and admin follows a group claim.
  Local login can be switched off entirely once SSO is live.

Zendesk and Jira
- Delivery is now implemented, behind three gates: the integration must be
  configured, its feature flag on, and CX_FEATURE_SEND_ENABLED on. A demo
  instance leaves the last off and cannot mail anyone. Both search before
  creating, so re-diagnosing an alert updates one ticket rather than opening
  several, and a rolling daily cap stops a loop mailing everybody.

Deployment
- Multi-stage Dockerfile builds the bundle and serves it from the API origin.
- docker-compose for local and single-host use; Gitea Actions runs the tests,
  builds the image and renders deploy/k8s with envsubst.

Two fixes found while testing: assigning a case returned a null assignee, and
add_event could leave an already-loaded history collection stale.

Known gap: the engine reaches OpenStack via `docker exec <region>-osc`, which
does not work in a pod without the CX-Tools containers alongside it.
docs/DEPLOYMENT.md sets out the three ways to close that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/pages/Login.tsx

@@ -0,0 +1,57 @@
+import { useState } from "react";
+import { api } from "../lib/api";
+import type { AppConfig } from "../types";
+
+export default function Login({ config, onSignedIn }: {
+  config: AppConfig | null; onSignedIn: () => void;
+}) {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState("");
+  const [busy, setBusy] = useState(false);
+
+  const submit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setBusy(true); setError("");
+    try {
+      await api.post("/api/auth/login", { email, password });
+      onSignedIn();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Sign-in failed");
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  return (
+    <div className="card login">
+      <h2 style={{ marginTop: 0 }}>{config?.app_name ?? "CX Triage"}</h2>
+
+      {config?.oidc_enabled && (
+        <>
+          <a className="navlink" style={{ display: "block", textAlign: "center", padding: 10 }}
+             href="/api/auth/oidc/start">Sign in with SSO</a>
+          {config.local_login && <div className="hint" style={{ textAlign: "center" }}>or use a local account</div>}
+        </>
+      )}
+
+      {config?.local_login !== false && (
+        <form onSubmit={submit} style={{ marginTop: 14 }}>
+          <div className="fld">
+            <label>Email</label>
+            <input value={email} onChange={(e) => setEmail(e.target.value)} autoComplete="username" />
+          </div>
+          <div className="fld">
+            <label>Password</label>
+            <input type="password" value={password} onChange={(e) => setPassword(e.target.value)}
+                   autoComplete="current-password" />
+          </div>
+          {error && <div className="warnbox t-bad">{error}</div>}
+          <button className="pri" style={{ width: "100%" }} disabled={busy}>
+            {busy ? "Signing in…" : "Sign in"}
+          </button>
+        </form>
+      )}
+    </div>
+  );
+}