feat(core): implement secure MVP core with dictionary search, auth, and CRUD

app/config.py

@@ -0,0 +1,40 @@
+import os
+from pathlib import Path
+
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+# Helper to read simple KEY=VALUE from .env without extra heavy dependencies
+def load_env_file(filepath: Path):
+    if not filepath.is_file():
+        return
+    with open(filepath, "r", encoding="utf-8") as f:
+        for line in f:
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, val = line.split("=", 1)
+            key = key.strip()
+            val = val.strip().strip("\"'")
+            if key not in os.environ:
+                os.environ[key] = val
+
+load_env_file(BASE_DIR / ".env")
+
+HOST = os.getenv("HOST", "127.0.0.1")
+PORT = int(os.getenv("PORT", "8002"))
+DEBUG = os.getenv("DEBUG", "False").lower() in ("1", "true", "yes")
+
+SECRET_KEY = os.getenv("SECRET_KEY", "default-dev-secret-key-please-change-in-production")
+SESSION_COOKIE_NAME = os.getenv("SESSION_COOKIE_NAME", "notes_session")
+SESSION_EXPIRE_DAYS = int(os.getenv("SESSION_EXPIRE_DAYS", "30"))
+
+RATE_LIMIT_LOGIN_MAX = int(os.getenv("RATE_LIMIT_LOGIN_MAX", "5"))
+RATE_LIMIT_LOGIN_WINDOW_SEC = int(os.getenv("RATE_LIMIT_LOGIN_WINDOW_SEC", "60"))
+
+ADMIN_USERNAME = os.getenv("ADMIN_USERNAME", "admin")
+ADMIN_PASSWORD = os.getenv("ADMIN_PASSWORD", "")
+
+MYMEMORY_EMAIL = os.getenv("MYMEMORY_EMAIL", "admin@qpid.pro")
+
+DB_PATH = Path(os.getenv("DB_PATH", str(BASE_DIR / "data" / "notes.db")))
+DB_PATH.parent.mkdir(parents=True, exist_ok=True)