DRE customer portal: FastAPI + SQLite backend (18 endpoints)

- Magic-link auth (sha256-only token storage, 15-min single-use, 7-day sessions)
- Staff-key auth via X-DRE-Staff-Key (constant-time compare)
- SQLite WAL, foreign_keys, parameterized queries, atomic DRE/CLT sequence allocation
- Intake validator rejects SSN/PAN patterns (FDCPA/TDCPA compliance)
- Document upload allowlist + magic-byte check, 20MB cap
- Unified error envelope, money as integer cents
- systemd unit (port 8093, User=root, hardening directives)
- Fixes import bug (auth.py relative imports) and audit_log placeholder mismatch

backend/dre-portal.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=DRE Customer Portal API (FastAPI/uvicorn)
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/dre-portal
+EnvironmentFile=/opt/dre-portal/.env
+ExecStart=/opt/dre-portal/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8093
+Restart=on-failure
+RestartSec=3
+User=root
+# hardening
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/opt/dre-portal/data
+# NOTE: ProtectHome=true would block reading /root; omitted so service can read env.
+# (ops-portal.service runs as root without ProtectHome for the same reason.)
+
+[Install]
+WantedBy=multi-user.target