DRE customer portal: FastAPI + SQLite backend (18 endpoints)

- Magic-link auth (sha256-only token storage, 15-min single-use, 7-day sessions)
- Staff-key auth via X-DRE-Staff-Key (constant-time compare)
- SQLite WAL, foreign_keys, parameterized queries, atomic DRE/CLT sequence allocation
- Intake validator rejects SSN/PAN patterns (FDCPA/TDCPA compliance)
- Document upload allowlist + magic-byte check, 20MB cap
- Unified error envelope, money as integer cents
- systemd unit (port 8093, User=root, hardening directives)
- Fixes import bug (auth.py relative imports) and audit_log placeholder mismatch

backend/.env.example

@@ -0,0 +1,23 @@
+# DRE Portal backend environment — copy to /opt/dre-portal/.env and fill in secrets (chmod 600)
+# Generated fresh DRE_STAFF_KEY on deploy (do NOT commit this file).
+
+# 64-hex random staff key (X-DRE-Staff-Key header) — generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
+DRE_STAFF_KEY=__GENERATE_ME__
+
+# SQLite DB path + uploads dir
+DRE_DB_PATH=/opt/dre-portal/data/dre.db
+DRE_UPLOAD_DIR=/opt/dre-portal/data/uploads
+
+# Base URL for magic-link emails
+DRE_BASE_URL=https://portal.debtrecoveryexperts.com
+
+# SMTP relay (germainebrown.com:2525 STARTTLS) — best-effort, failures never fail the request
+DRE_SMTP_HOST=mail.germainebrown.com
+DRE_SMTP_PORT=2525
+DRE_SMTP_FROM=dre@debtrecoveryexperts.com
+DRE_TEAM_NOTIFY=dre@debtrecoveryexperts.com
+DRE_SMTP_USER=shonuff@germainebrown.com
+DRE_SMTP_PASS=__FROM_HIMALAYA_PASSFILE__
+
+# Optional Cloudflare Turnstile (intake skips captcha if unset)
+# TURNSTILE_SECRET=