refactor: decompose monolith — app.py 10,600→143 lines, 30+ modules

Fase 0 complete: extract all business logic, auth, database, and 176
endpoints from monolithic app.py into dedicated modules.

Structure:
- app.py: FastAPI hub (CORS, routers, startup/shutdown)
- models.py: 13 Pydantic request models
- utils.py: shared utilities (embed status, upload validation, process registries)
- config.py: constants, env vars, model catalogs
- auth/: crypto, jwt_auth, oidc, rate_limit
- database/: db(), init_db(), schema DDL
- services/: genai, compliance, chat, terraform, embeddings, cis_reports, mcp
- routes/: 13 APIRouter modules (auth, users, oci_config, oci_explorer,
  genai, mcp, adb, embeddings, reports, chat, terraform, settings, cis_engine)

Also: README updated with OCIR auth instructions for manual docker run.

86 tests passing.

backend/models.py

@@ -0,0 +1,74 @@
+"""Pydantic request models for API endpoints."""
+from typing import Optional, List, Dict, Any
+from pydantic import BaseModel
+
+
+class LoginReq(BaseModel):
+    username: str; password: str; totp_code: Optional[str] = None
+
+class RegisterReq(BaseModel):
+    first_name: str; last_name: str; username: str; email: str; password: str; role: str = "viewer"
+
+class TOTPVerify(BaseModel):
+    totp_code: str
+
+class ChangePwReq(BaseModel):
+    current_password: str; new_password: str
+
+class UserUpdateReq(BaseModel):
+    email: Optional[str] = None; role: Optional[str] = None; is_active: Optional[bool] = None; timezone: Optional[str] = None
+
+class ChatMsg(BaseModel):
+    message: str; session_id: Optional[str] = None
+    genai_config_id: Optional[str] = None
+    model_id: Optional[str] = None; oci_config_id: Optional[str] = None
+    genai_region: Optional[str] = None; compartment_id: Optional[str] = None
+    temperature: Optional[float] = None; max_tokens: Optional[int] = None
+    top_p: Optional[float] = None; top_k: Optional[int] = None
+    frequency_penalty: Optional[float] = None; presence_penalty: Optional[float] = None
+    reasoning_effort: Optional[str] = None
+    use_tools: Optional[bool] = True
+
+class RunReportReq(BaseModel):
+    config_id: str; regions: Optional[List[str]] = None
+    level: int = 2; obp: bool = False; raw: bool = False; redact_output: bool = False
+
+class GenAIConfigReq(BaseModel):
+    name: str = "default"
+    oci_config_id: str; model_id: str; model_ocid: Optional[str] = None
+    compartment_id: str; genai_region: str
+    endpoint: Optional[str] = None
+    serving_type: str = "ON_DEMAND"; dedicated_endpoint_id: Optional[str] = None
+    temperature: float = 1; max_tokens: int = 6000; top_p: float = 0.95
+    top_k: int = 1; frequency_penalty: float = 0; presence_penalty: float = 0
+    reasoning_effort: Optional[str] = None
+    is_default: bool = False
+
+class IngestDocReq(BaseModel):
+    adb_config_id: str; documents: List[Dict[str, Any]]; table_name: Optional[str] = None
+
+class MCPServerReq(BaseModel):
+    name: str; description: Optional[str] = None; server_type: str = "stdio"
+    command: Optional[str] = None; args: Optional[List[str]] = None
+    env_vars: Optional[Dict[str, str]] = None; url: Optional[str] = None
+    module_path: Optional[str] = None; tools: Optional[List[dict]] = None
+    linked_adb_id: Optional[str] = None; is_global: bool = False
+
+class ConsultQuery(BaseModel):
+    query: str
+    table_name: str = ""
+    top_k: int = 10
+    oci_config_id: str = ""
+
+class TfPromptReq(BaseModel):
+    message: str
+    genai_config: Optional[dict] = None
+    history: Optional[list] = None
+    session_id: Optional[str] = None
+
+class TfWorkspaceReq(BaseModel):
+    session_id: str
+    oci_config_id: str
+    compartment_id: Optional[str] = None
+    name: str = "workspace"
+    tf_code: str