feat(08): implement SSOT architecture for network configuration

backend/config_loader.py

@@ -201,7 +201,38 @@ def load_config() -> dict:
         except Exception as e:
             log.warning(f"⚠️ Failed to load {secrets_yaml_path}: {e}")
 
-    # 4. Apply Environment Overrides (D-06)
+    # 4. Load network.yaml (SSOT for infrastructure)
+    network_yaml_path = os.path.join(config_dir, "network.yaml")
+    if os.path.exists(network_yaml_path):
+        try:
+            with open(network_yaml_path, 'r') as f:
+                network_data = yaml.safe_load(f) or {}
+                # Map infrastructure settings to application domain
+                infra = network_data.get("application", {})
+                if "server_ip" in infra:
+                    config["application"]["server_ip"] = infra["server_ip"]
+                if "cors_origins" in infra:
+                    # Append or override? Plan says establish as master. 
+                    # We merge with any existing ones.
+                    existing = config["application"].get("cors_origins", "")
+                    if existing:
+                        config["application"]["cors_origins"] = f"{infra['cors_origins']},{existing}"
+                    else:
+                        config["application"]["cors_origins"] = infra["cors_origins"]
+                
+                # Map ports to application domain for CORS logic
+                ports = network_data.get("ports", {})
+                for key, val in ports.items():
+                    config["application"][key] = val
+                    
+                # Map SSL state
+                config["application"]["ssl_enabled"] = network_data.get("ssl", {}).get("ssl_enabled", False)
+                
+            log.info(f"✅ Loaded network topology from {network_yaml_path}")
+        except Exception as e:
+            log.warning(f"⚠️ Failed to load {network_yaml_path}: {e}")
+
+    # 5. Apply Environment Overrides (D-06)
     _apply_env_overrides(config)
 
     _config = config