T10: Monitoring, Performance, Documentation & Environment Config — 38 tests, ruff clean, docs OK

- Extended health endpoint: DB+Redis+Storage+Worker checks with degraded status
- Prometheus metrics endpoint: admin-only, text/plain format
- Metrics: http_requests_total, db_pool_connections, arq_jobs_total
- Structured JSON logging (structlog): timestamp, level, method, path, status, duration_ms, tenant_id
- Performance: page_size max 100 enforced (422), streaming CSV export (StreamingResponse)
- Scripts: seed_perf_data.py, check_indexes.py
- Docs: admin-guide.md (Deploy, Backup, Restore, Env-Vars, Troubleshooting), api-overview.md
- README updated: prod setup, API section, env profiles, admin-guide link
- .env.example: added SECRET_KEY, STORAGE_PATH, SMTP_* vars
- 38 new tests, full regression 564/564 pass (0 failures)
- Ruff: all checks passed

app/config.py

@@ -40,6 +40,20 @@ class Settings(BaseSettings):
     session_cookie_httponly: bool = True
     password_reset_expiry_hours: int = 1
 
+    # Storage
+    storage_path: str = "/tmp"
+
+    # SMTP
+    smtp_host: str = "localhost"
+    smtp_port: int = 587
+    smtp_username: str | None = None
+    smtp_password: str | None = None
+    smtp_from_email: str = "noreply@leocrm.local"
+    smtp_use_tls: bool = True
+
+    # Secret Key (for signing, sessions, etc.)
+    secret_key: str = "change-me-in-production-use-a-secure-random-string"
+
     # CORS
     cors_origins: str = "http://localhost:5173,http://localhost:3000"