91 clean up code for aws integration

.dockerignore

@@ -0,0 +1,63 @@
+.git
+.gitignore
+.gitattributes
+.github
+.env
+.env.*
+
+**/__pycache__
+**/*.py[cod]
+**/.pytest_cache
+**/.mypy_cache
+**/.ruff_cache
+**/.cache
+.coverage
+.coverage.*
+coverage.xml
+htmlcov
+
+.venv
+venv
+env
+ENV
+**/*.egg-info
+build
+dist
+
+frontend/node_modules
+frontend/dist
+frontend/.test-dist
+node_modules
+
+*.db
+*.db-*
+*.sqlite
+*.sqlite3
+*.sqlite-*
+src/data/**
+!src/data/*.py
+**/raw/**
+**/processed/**
+**/preprocessed/**
+**/browser-profile/**
+**/browser_profiles/**
+**/playwright-report/**
+**/test-results/**
+
+docs
+exports
+**/exports/**
+**/audit-staging/**
+**/*.tfstate
+**/*.tfstate.*
+
+*.log
+*.tmp
+*.temp
+*.bak
+*.swp
+*.swo
+.DS_Store
+._*
+
+*.ipynb

.env.example

@@ -1,10 +1,66 @@
-# Copy to .env. The real .env is ignored by Git; never commit secrets.
-JWT_SECRET_KEY=replace-with-a-long-random-secret
-JWT_ALGORITHM=HS256
+# Copy to .env for local work only. The real .env is ignored by Git; never commit secrets.
+APP_ENV=development
+# Operational deployments default to PostgreSQL. The SQLite mode is local/test
+# migration compatibility only; shadow_compare requires a separate snapshot.
+# DATA_RUNTIME_MODE=postgresql
+# SHADOW_SQLITE_PATH=/absolute/path/to/coherent-shadow-snapshot.db
+AUTH_MODE=disabled
 ACCESS_TOKEN_EXPIRE_MINUTES=30
-BFF_ADMIN_USER=admin
-BFF_ADMIN_PASSWORD=password
-CORE_API_URL=http://localhost:8080
+SESSION_COOKIE_SECURE=false
+CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+
+# Production/staging must use OIDC and inject these values through the runtime.
+# AUTH_MODE=oidc
+# OIDC_ISSUER=https://identity.example.invalid/
+# OIDC_AUDIENCE=foundation-intelligence-api
+# OIDC_JWKS_URL=https://identity.example.invalid/.well-known/jwks.json
+# OIDC_ROLE_CLAIM=roles
+
+# Explicit local-only authentication. Use unique values; no defaults are supplied.
+# AUTH_MODE=development
+# DEV_AUTH_ENABLED=true
+# DEV_AUTH_USERNAME=
+# DEV_AUTH_PASSWORD=
+# DEV_AUTH_SECRET=
+# DEV_AUTH_ALLOWED_HOSTS=127.0.0.1,::1,localhost
+
+# Public, non-production demo only. Both values are required together. This
+# mode has no login/session and exposes only the reviewed aggregate route
+# allowlist in bff.security; all other API routes remain protected.
+# APP_ENV=demo
+# DATA_RUNTIME_MODE=postgresql
+# AUTH_MODE=public_readonly
+# DEV_AUTH_ENABLED=false
+# CORE_PROXY_ENABLED=false
+# CORS_ORIGINS=
+
+RATE_LIMIT_REQUESTS=120
+RATE_LIMIT_WINDOW_SECONDS=60
+MAX_REQUEST_BODY_BYTES=1048576
+REQUEST_TIMEOUT_SECONDS=30
+
+# PostgreSQL readiness/runtime configuration. Prefer a mounted secret file.
+# DATABASE_URL=postgresql+asyncpg://user:password@localhost:5432/foundation_intelligence
+DATABASE_HOST=127.0.0.1
+DATABASE_PORT=5432
+DATABASE_NAME=foundation_intelligence
+DATABASE_USER=foundation_app
+# DATABASE_PASSWORD_FILE=/absolute/path/to/postgres_password
+# AWS/RDS tasks use encrypted PostgreSQL transport.
+DATABASE_SSL_MODE=disable
+DATABASE_POOL_SIZE=5
+DATABASE_MAX_OVERFLOW=5
+DATABASE_POOL_TIMEOUT_SECONDS=5
+DATABASE_CONNECT_TIMEOUT_SECONDS=5
+DATABASE_STATEMENT_TIMEOUT_MS=30000
+
+CORE_PROXY_ENABLED=false
+CORE_API_URL=http://127.0.0.1:8080
+# CORE_API_ALLOWED_HOSTS=127.0.0.1
+# CORE_PROXY_ALLOWED_PATHS=v1/data
+# CORE_PROXY_ALLOWED_METHODS=GET
+# CORE_PROXY_FORWARD_HEADERS=accept,content-type,x-request-id
+# CORE_API_BEARER_TOKEN=
 DB_PATH=src/data/charities.db
 DATA_PATH=src/data/raw/register_of_charities_results.json
 SCORE_CONFIG_PATH=config/scoring.example.json