Extract API, migrations and portable NAS deployment

infra/synology/standalone.env.example

@@ -0,0 +1,27 @@
+# Enter these variables in Container Manager when creating the container.
+# Use the NAS LAN IP (or a reachable bridge gateway), never container localhost.
+DB_HOST=10.0.0.200
+DB_PORT=3306
+DB_NAME=model_delivery
+DB_USER=model_app
+DB_PASSWORD=REPLACE_WITH_DATABASE_PASSWORD
+
+# Your final Web Station HTTPS origin; no subdirectory.
+APP_URL=https://deliveries.example.com
+# Separate HTTPS admin origin, restricted to your LAN, targeting port 38081.
+ADMIN_URL=https://deliveries-admin.example.com
+COOKIE_SECURE=true
+
+# Generate two independent secrets. Preserve the encryption key with DB backups.
+TOKEN_ENCRYPTION_KEY=REPLACE_WITH_32_RANDOM_BYTES_IN_BASE64
+LOCAL_ADMIN_SETUP_TOKEN=REPLACE_WITH_RANDOM_SETUP_CODE
+
+# Optional: configure SSO here, or through the guarded administration page.
+OIDC_ISSUER=
+OIDC_DISCOVERY_URL=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_SCOPES=openid groups
+# OIDC_REDIRECT_URI defaults to APP_URL + /api/auth/callback.
+# APP_ORIGINS defaults to APP_URL and ADMIN_URL. Both can be overridden explicitly.
+# Stored SSO settings in MariaDB take precedence over initial OIDC_* variables.