RegWatch backend : FastAPI + Postgres partagé + Docker/CI homelab

- SECRET_KEY et DATABASE_URL externalisés (Vault -> env), plus de secret en dur
- SQLite -> postgres-shared (psycopg2), schéma créé au boot (entrypoint.sh)
- Dockerfile + docker-compose (Watchtower) + .gitea/workflows/build.yml

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

database/database.py

@@ -0,0 +1,25 @@
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker, declarative_base
+import os
+
+# En prod (homelab) : DATABASE_URL pointe sur postgres-shared (injecté par l'env / Vault).
+# En dev local : repli sur un SQLite à la racine du backend.
+DB_PATH = os.path.join(os.path.dirname(os.path.dirname(__file__)), "regwatch.db")
+DATABASE_URL = os.getenv("DATABASE_URL", f"sqlite:///{DB_PATH}")
+
+# check_same_thread n'a de sens que pour SQLite.
+connect_args = {"check_same_thread": False} if DATABASE_URL.startswith("sqlite") else {}
+
+engine = create_engine(
+    DATABASE_URL,
+    connect_args=connect_args,
+    pool_pre_ping=True,
+)
+
+SessionLocal = sessionmaker(
+    autocommit=False,
+    autoflush=False,
+    bind=engine
+)
+
+Base = declarative_base()

database/models.py

@@ -0,0 +1,21 @@
+from sqlalchemy import Column, Integer, String
+from database.database import Base
+
+class User(Base):
+    __tablename__ = "users"
+
+    id = Column(Integer, primary_key=True, index=True)
+    email = Column(String, unique=True, index=True)
+    password = Column(String)
+    full_name = Column(String, nullable=True)
+
+class Document(Base):
+    __tablename__ = "documents"
+
+    id = Column(Integer, primary_key=True, index=True)
+    title = Column(String)
+    ingredient = Column(String)
+    source = Column(String)
+    document_type = Column(String)
+    meeting_date = Column(String, nullable=True)
+    pdf_url = Column(String, unique=True)