Extract API, migrations and portable NAS deployment

.env.example

@@ -0,0 +1,29 @@
+# Local development only. Copy to .env and set your own passwords.
+DB_HOST=127.0.0.1
+DB_PORT=3307
+DB_NAME=model_delivery
+DB_USER=model_app
+DB_PASSWORD=change-me-local-app
+DB_ROOT_PASSWORD=change-me-local-root
+API_HOST=127.0.0.1
+API_PORT=3001
+LOG_LEVEL=info
+# Local HTTP only; set true with trusted HTTPS deployment.
+COOKIE_SECURE=false
+APP_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,http://localhost:4173,http://127.0.0.1:4173
+# Generate locally: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+TOKEN_ENCRYPTION_KEY=
+# One-time setup code for /local-admin; choose a random long value. Never commit it.
+LOCAL_ADMIN_SETUP_TOKEN=
+# Optional initial SSO settings; the guarded local-admin UI can override these.
+OIDC_ISSUER=
+OIDC_DISCOVERY_URL=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URI=http://localhost:5173/api/auth/callback
+OIDC_SCOPES=openid
+# Only permits HTTP on loopback for the automated OIDC test provider.
+OIDC_ALLOW_HTTP=false
+# Optional AD display-name lookup is disabled by default. Configure its internal
+# LDAPS URL, base DN, domain, read account/password and CA at /local-admin.
+# Directory credentials use TOKEN_ENCRYPTION_KEY and are stored only in MariaDB.