Server: FastAPI backend with auth, projects, reports, uploads ...

- FastAPI + SQLAlchemy async + Alembic, PostgreSQL in docker-compose
- Auth: argon2id, cookie sessions (web) + bearer tokens (extension)
- Unguessable share tokens (128-bit) on projects and reports
- Content-addressed file storage with mime sniffing, token-scoped download
- Reports with nested steps; server-side password masking

Co-Authored-By: Claude Code <noreply@anthropic.com>