v0.3.0: OAuth2, CSRF, rate limiting, issue CRUD, webhooks, card detail, checklists

- OAuth2 Gitea (login/callback/logout) with fallback admin mode
- Session management with signed cookies (itsdangerous, 7 days)
- CSRF protection middleware on all POST/PUT/PATCH/DELETE
- Rate limiting in-memory (60 req/min per IP)
- Issue creation from FlowDeck (POST /api/issues/{owner}/{repo})
- Inline issue editing (PATCH /api/issues/{owner}/{repo}/{issue_id})
- Card detail modal (double-click): description, labels, comments
- Checklists with toggleable items (CRUD endpoints + UI)
- Priority + due date editable on cards
- Webhook receiver (POST /api/webhook) with HMAC-SHA256
- Auto-register/status webhooks for repos
- GiteaClient: create_issue, update_issue, get_comments, webhooks, collaborators
- New DB tables: users, user_tokens, checklists, checklist_items
- CSS: modal, forms, checklists, comments, PR section

app/config.py

@@ -17,6 +17,12 @@ class Settings(BaseSettings):
     gitea_oauth_client_secret: str = ""
     gitea_webhook_secret: str = ""
 
+    # OAuth2
+    oauth_redirect_uri: str = "http://localhost:8080/auth/callback"
+
+    # Webhook
+    webhook_base_url: str = "http://localhost:8080"
+
     # App
     app_secret_key: str = "change-me-to-random"
     app_host: str = "0.0.0.0"
@@ -24,6 +30,10 @@ class Settings(BaseSettings):
     log_level: str = "INFO"
     default_lang: str = "fr"
 
+    # Rate limiting
+    rate_limit_enabled: bool = True
+    rate_limit_requests: int = 60  # per minute
+
     # Database
     database_url: str = "sqlite:////data/flowdeck.db"