chore(backend): bootstrap Python 3.12+ project skeleton (B0.1)

- pyproject.toml with ruff + mypy strict + pytest + coverage >=70%
- Makefile with Docker/Podman auto-detect
- Multi-stage Dockerfile (python:3.12-slim-bookworm, non-root user)
- docker-compose.yml for Postgres dev DB
- alembic.ini wired to src/mimic/db/migrations
- scripts/postgres-init/00-roles.sql seeds the audit writer role
- .env.example documents every MIMIC_* var (no secrets committed)

backend/pyproject.toml

@@ -0,0 +1,147 @@
+[build-system]
+requires = ["hatchling>=1.24"]
+build-backend = "hatchling.build"
+
+[project]
+name = "mimic"
+version = "0.1.0a0"
+description = "Mimic — internal BAS platform (sprint 0 skeleton)"
+readme = "README.md"
+requires-python = ">=3.12"
+license = { text = "Proprietary" }
+authors = [{ name = "RT" }]
+
+dependencies = [
+    "flask>=3.0,<4.0",
+    "flask-socketio>=5.3,<6.0",
+    "flask-login>=0.6.3,<1.0",
+    "flask-migrate>=4.0,<5.0",
+    "sqlalchemy>=2.0,<3.0",
+    "alembic>=1.13,<2.0",
+    "psycopg[binary]>=3.1,<4.0",
+    "pydantic>=2.6,<3.0",
+    "pydantic-settings>=2.2,<3.0",
+    "python-json-logger>=2.0,<3.0",
+    "structlog>=24.1,<25.0",
+    "bcrypt>=4.1,<5.0",
+    "cryptography>=42.0,<43.0",
+    "jinja2>=3.1,<4.0",
+    "google-re2>=1.1,<2.0",
+    "click>=8.1,<9.0",
+    "gevent>=24.2,<25.0",
+    "gevent-websocket>=0.10,<1.0",
+    "httpx>=0.27,<1.0",
+    "weasyprint>=61.0,<62.0",
+    "authlib>=1.3,<2.0",
+    "pyyaml>=6.0,<7.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0,<9.0",
+    "pytest-cov>=5.0,<6.0",
+    "pytest-flask>=1.3,<2.0",
+    "pytest-mock>=3.12,<4.0",
+    "testcontainers[postgres]>=4.4,<5.0",
+    "ruff>=0.4,<1.0",
+    "mypy>=1.10,<2.0",
+    "types-pyyaml>=6.0,<7.0",
+    "freezegun>=1.5,<2.0",
+]
+
+[project.scripts]
+mimic-cli = "mimic.cli:cli"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/mimic"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/mimic", "README.md", "pyproject.toml"]
+
+# -- Ruff -------------------------------------------------------------------
+
+[tool.ruff]
+line-length = 100
+target-version = "py312"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = [
+    "E", "F", "W",      # pycodestyle / pyflakes
+    "I",                # isort
+    "B",                # bugbear
+    "UP",               # pyupgrade
+    "N",                # pep8-naming
+    "S",                # flake8-bandit (security)
+    "C4",               # comprehensions
+    "DTZ",              # datetime tz
+    "PIE",
+    "PT",               # pytest
+    "RET",
+    "SIM",
+    "TID",
+    "PL",
+    "RUF",
+]
+ignore = [
+    "PLR0913",          # too many args (Flask handlers + DI)
+    "S101",             # assert in tests
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["S101", "S105", "S106", "PLR2004"]
+"src/mimic/db/migrations/**" = ["E501", "N999"]
+
+[tool.ruff.lint.isort]
+known-first-party = ["mimic"]
+
+# -- Mypy -------------------------------------------------------------------
+
+[tool.mypy]
+python_version = "3.12"
+strict = true
+warn_unreachable = true
+warn_unused_ignores = true
+show_error_codes = true
+plugins = ["pydantic.mypy"]
+exclude = ["src/mimic/db/migrations/versions/"]
+
+[[tool.mypy.overrides]]
+module = [
+    "weasyprint.*",
+    "google.re2.*",
+    "re2",
+    "flask_socketio.*",
+    "flask_migrate.*",
+    "gevent.*",
+    "testcontainers.*",
+    "authlib.*",
+]
+ignore_missing_imports = true
+
+# -- Pytest -----------------------------------------------------------------
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers --strict-config"
+markers = [
+    "integration: requires testcontainers Postgres",
+    "slow: long-running tests",
+]
+filterwarnings = ["error"]
+
+[tool.coverage.run]
+branch = true
+source = ["src/mimic"]
+omit = ["src/mimic/db/migrations/*"]
+
+[tool.coverage.report]
+fail_under = 70
+show_missing = true
+skip_covered = false
+exclude_lines = [
+    "pragma: no cover",
+    "raise NotImplementedError",
+    "if TYPE_CHECKING:",
+    "\\.\\.\\.",
+]