T01: core infrastructure + auth + multi-tenant + RLS

- 10 models: tenants, users, user_tenants, roles, sessions, audit_log, deletion_log, notifications, password_reset_tokens, api_tokens
- Session-based auth (Redis + PostgreSQL audit trail)
- Multi-tenant with ORM-level filtering + PostgreSQL RLS (set_config)
- RBAC with roles/permissions + field-level permissions
- CSRF protection via Origin header validation
- Auth rate limiting (Redis counters with TTL)
- CORS with explicit origins (no wildcard)
- Health endpoint (no auth required)
- Notification service + audit log middleware
- 29 tests, 26 ACs, all passing
- Coverage: 62% (infrastructure modules pending coverage in later tasks)

.env.example

@@ -1,34 +1,42 @@
-# CRM System v1.0 - Environment Variables Template
-# Copy this file to .env and fill in real values
-# .env is gitignored, NEVER commit it
+# LeoCRM v1.0 - Environment Variables Template
 
 # === REQUIRED ===
-# JWT signing secret. MUST be at least 32 characters.
-# Generate with: python -c "import secrets; print(secrets.token_urlsafe(48))"
-# In production, this is auto-injected by Coolify as SERVICE_BASE64_64.
-AUTH_SECRET=replace-me-with-a-secure-random-string-at-least-32-chars-long
+DATABASE_URL=postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm
+REDIS_URL=redis://localhost:6379/0
 
 # === OPTIONAL (with defaults) ===
 
-# Database URL. Driver-agnostic (aiosqlite or asyncpg).
-# Dev default: SQLite file ./dev.db
-# Prod example: postgresql+asyncpg://user:pass@host:5432/dbname
-DATABASE_URL=sqlite+aiosqlite:///./dev.db
-
-# JWT settings
-JWT_ALGORITHM=HS256
-JWT_EXPIRY_HOURS=24
-
-# Password hashing rounds (bcrypt)
-BCRYPT_ROUNDS=12
-
-# CORS allowed origins (comma-separated, NO wildcards)
-# Dev: http://localhost:5500,http://localhost:8000
-# Prod: https://crm.media-on.de
-CORS_ORIGINS=http://localhost:5500,http://localhost:8000
-
-# Environment: development | production
+# Environment: development | production | testing
 ENVIRONMENT=development
 
 # Log level: DEBUG | INFO | WARNING | ERROR
 LOG_LEVEL=INFO
+
+# Database pool
+DB_POOL_SIZE=10
+DB_MAX_OVERFLOW=20
+DB_ECHO=false
+
+# Session settings
+SESSION_TTL_SECONDS=28800
+SESSION_COOKIE_NAME=leocrm_session
+SESSION_COOKIE_SECURE=false
+SESSION_COOKIE_SAMESITE=strict
+SESSION_COOKIE_HTTPONLY=true
+
+# Password hashing
+BCRYPT_ROUNDS=12
+PASSWORD_RESET_EXPIRY_HOURS=1
+
+# CORS allowed origins (comma-separated, NO wildcards)
+CORS_ORIGINS=http://localhost:5173,http://localhost:3000
+
+# Rate limiting
+RATE_LIMIT_LOGIN_MAX=5
+RATE_LIMIT_LOGIN_WINDOW=900
+RATE_LIMIT_RESET_MAX=3
+RATE_LIMIT_RESET_WINDOW=3600
+RATE_LIMIT_RESET_CONFIRM_MAX=5
+RATE_LIMIT_RESET_CONFIRM_WINDOW=3600
+RATE_LIMIT_GENERAL_MAX=60
+RATE_LIMIT_GENERAL_WINDOW=60