M1: implement operational core

Demo auth, seed import/reset, dashboard, vehicle/booking list+detail, audit trail. Backend: 19 tests passing, ruff clean. Frontend: React Router shell, typed API client, responsive pages. Verified end-to-end via curl and browser.

backend/app/core/config.py

@@ -15,6 +15,12 @@ class Settings(BaseSettings):
     ragcore_workspace: str = "mobilityops"
     ragcore_collection: str = "internal-procedures"
     n8n_webhook_url: str = "http://n8n:5678/webhook/mobilityops-return"
+    app_secret: str = "replace-in-production"
+    session_cookie_name: str = "mobilityops_session"
+    session_ttl_seconds: int = 60 * 60 * 8
+    seed_dir: str = "/app/seed"
+    cors_allow_origins: str = "http://localhost:1228"
+    demo_today: str = "2026-08-01"
 
 
 @lru_cache

backend/app/core/errors.py

@@ -0,0 +1,31 @@
+from __future__ import annotations
+
+import uuid
+from typing import Any
+
+
+class AppError(Exception):
+    def __init__(
+        self,
+        code: str,
+        message: str,
+        status_code: int = 400,
+        details: dict[str, Any] | None = None,
+    ) -> None:
+        super().__init__(message)
+        self.code = code
+        self.message = message
+        self.status_code = status_code
+        self.details = details or {}
+        self.correlation_id = str(uuid.uuid4())
+
+
+def error_body(code: str, message: str, correlation_id: str, details: dict[str, Any]) -> dict:
+    return {
+        "error": {
+            "code": code,
+            "message": message,
+            "correlation_id": correlation_id,
+            "details": details,
+        }
+    }

backend/app/core/security.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import time
+from dataclasses import dataclass
+
+from app.core.config import get_settings
+
+settings = get_settings()
+
+
+@dataclass(frozen=True)
+class SessionPayload:
+    user_id: str
+    public_ref: str
+    role: str
+    display_name: str
+    issued_at: int
+
+
+def _sign(data: bytes) -> str:
+    digest = hmac.new(settings.app_secret.encode(), data, hashlib.sha256).digest()
+    return base64.urlsafe_b64encode(digest).decode().rstrip("=")
+
+
+def create_session_token(payload: SessionPayload) -> str:
+    body = json.dumps(payload.__dict__, separators=(",", ":")).encode()
+    encoded_body = base64.urlsafe_b64encode(body).decode().rstrip("=")
+    signature = _sign(encoded_body.encode())
+    return f"{encoded_body}.{signature}"
+
+
+def read_session_token(token: str) -> SessionPayload | None:
+    try:
+        encoded_body, signature = token.split(".", 1)
+    except ValueError:
+        return None
+    expected = _sign(encoded_body.encode())
+    if not hmac.compare_digest(expected, signature):
+        return None
+    padding = "=" * (-len(encoded_body) % 4)
+    try:
+        body = json.loads(base64.urlsafe_b64decode(encoded_body + padding))
+    except (ValueError, json.JSONDecodeError):
+        return None
+    payload = SessionPayload(**body)
+    if time.time() - payload.issued_at > settings.session_ttl_seconds:
+        return None
+    return payload