refactor: decompose monolith — app.py 10,600→143 lines, 30+ modules

Fase 0 complete: extract all business logic, auth, database, and 176
endpoints from monolithic app.py into dedicated modules.

Structure:
- app.py: FastAPI hub (CORS, routers, startup/shutdown)
- models.py: 13 Pydantic request models
- utils.py: shared utilities (embed status, upload validation, process registries)
- config.py: constants, env vars, model catalogs
- auth/: crypto, jwt_auth, oidc, rate_limit
- database/: db(), init_db(), schema DDL
- services/: genai, compliance, chat, terraform, embeddings, cis_reports, mcp
- routes/: 13 APIRouter modules (auth, users, oci_config, oci_explorer,
  genai, mcp, adb, embeddings, reports, chat, terraform, settings, cis_engine)

Also: README updated with OCIR auth instructions for manual docker run.

86 tests passing.

backend/services/oci_helpers.py

@@ -0,0 +1,31 @@
+"""OCI SDK client helpers — config loading, signer creation, client factory."""
+from config import OCI_DIR
+
+
+def _get_oci_config(oci_config_id: str) -> dict:
+    import oci
+    config_path = str(OCI_DIR / oci_config_id / "config")
+    config = oci.config.from_file(config_path, "DEFAULT")
+    return config
+
+
+def _get_oci_signer(oci_config_id: str):
+    """Return (config, signer) tuple. For session_token auth, returns SecurityTokenSigner; for api_key returns None."""
+    import oci
+    config = _get_oci_config(oci_config_id)
+    if config.get("security_token_file"):
+        from oci.auth.signers import SecurityTokenSigner
+        token_path = config["security_token_file"]
+        with open(token_path) as f:
+            token = f.read().strip()
+        signer = SecurityTokenSigner(token, config["key_file"])
+        return config, signer
+    return config, None
+
+
+def _oci_client(client_class, oci_config_id: str, **kwargs):
+    """Create an OCI client with correct auth (api_key or session_token)."""
+    config, signer = _get_oci_signer(oci_config_id)
+    if signer:
+        return client_class(config=config, signer=signer, **kwargs)
+    return client_class(config, **kwargs)