chore: монорепо, dev-окружение и деплой

Nix flake на два шелла (backend и + Flutter), justfile как единая точка входа,
локальный Postgres в ./.pgdata на порту 54329, docker-compose из пяти сервисов
(db, api, worker, caddy, pg-backup) и CI на ruff/pyright/pytest + дрейф OpenAPI.

Российские корневые сертификаты лежат в репозитории: они публичные, но нужны и
Caddy, и gRPC-каналу T-Invest, а глобальный gitignore отбрасывает *.pem.

.env.example

@@ -0,0 +1,25 @@
+# Copy to .env (never committed). On the VPS, docker compose reads this file.
+
+# --- database ---
+POSTGRES_DB=fintracker
+POSTGRES_USER=fintracker
+POSTGRES_PASSWORD=change-me
+# used by api/worker; inside compose the host is `db`
+DATABASE_URL=postgresql+asyncpg://fintracker:change-me@db:5432/fintracker
+
+# --- auth ---
+# 32+ random bytes: `openssl rand -hex 32`
+JWT_SECRET=change-me
+ACCESS_TOKEN_TTL_SECONDS=3600
+REFRESH_TOKEN_TTL_SECONDS=2592000
+
+# --- web ---
+DOMAIN=fin.example.com
+# comma-separated; leave empty when the Flutter web build is served by Caddy from the same origin
+CORS_ORIGINS=
+# dev only: serve a Flutter web build from the API process (prod uses Caddy)
+WEB_DIR=
+
+# --- sources (filled in later phases) ---
+ZENMONEY_TOKEN=
+TINVEST_TOKEN=