Implement KCA: web reimplementation of XCA PKI workflows

- kaya backend with OIDC sessions, API tokens, Postgres/Tortoise models
- AES-256-GCM private key storage and full certificate/CSR/CRL domain logic
- Sycamore/WASM SPA for vaults, keys, requests, certificates, CRLs and templates
- imports/exports, XCA .xdb migration, Docker Compose stack and tests

server/pyproject.toml

@@ -0,0 +1,57 @@
+# KCA backend workspace.
+#
+# The pure domain logic lives in packages/kca-core (no kaya, no database);
+# the deployable application lives in packages/kca-app. This file is the uv
+# workspace root and also holds the tooling configuration read from server/
+# (uv, aerich, mypy).
+
+[tool.uv]
+index-strategy = "unsafe-best-match"
+
+[[tool.uv.index]]
+name = "gitea"
+url = "https://gitea.woggioni.net/api/packages/woggioni/pypi/simple"
+default = true
+
+[[tool.uv.index]]
+name = "pypi"
+url = "https://pypi.org/simple"
+
+[tool.uv.workspace]
+members = ["packages/*"]
+
+[tool.uv.sources]
+kca-core = { workspace = true }
+
+[tool.aerich]
+tortoise_orm = "kca.aerich_config.TORTOISE_ORM"
+location = "./migrations"
+
+[tool.mypy]
+python_version = "3.12"
+ignore_missing_imports = true
+plugins = []
+
+[[tool.mypy.overrides]]
+module = "kca.models"
+disable_error_code = ["attr-defined", "assignment", "var-annotated"]
+
+[[tool.mypy.overrides]]
+module = "kca.service"
+disable_error_code = ["attr-defined", "assignment", "index", "arg-type"]
+
+[[tool.mypy.overrides]]
+module = "kca.core.imports"
+disable_error_code = ["assignment", "attr-defined"]
+
+[[tool.mypy.overrides]]
+module = "kca.core.exports"
+disable_error_code = ["arg-type"]
+
+[[tool.mypy.overrides]]
+module = "kca.routes.*"
+disable_error_code = ["attr-defined", "assignment", "index", "arg-type"]
+
+[[tool.mypy.overrides]]
+module = "kca.core.*"
+disable_error_code = ["arg-type", "assignment", "attr-defined", "index", "return-value", "var-annotated"]