feat(08): implement SSOT architecture for network configuration

config/Caddyfile.standalone

@@ -0,0 +1,41 @@
+# TFM aInventory - Caddy Patched IP Configuration
+# Version 1.9.17 - The Dynamic Shield (Production Polish)
+{
+    admin off
+    # Global TLS options for self-signed certificates
+    local_certs
+    skip_install_trust
+    
+    # Configure on-demand TLS for private network IPs
+    on_demand_tls {
+        # Pointing to the backend root which returns 200 OK
+        # This allows Caddy to generate internal certs for any IP/domain.
+        ask http://backend:8000/
+    }
+}
+
+# Dynamic SSL Proxy (Matches ANY IP or hostname)
+https:// {
+    tls internal {
+        on_demand
+    }
+    
+    reverse_proxy frontend:3000
+    
+    header {
+        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+        X-XSS-Protection "1; mode=block"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        Referrer-Policy "strict-origin-when-cross-origin"
+    }
+}
+
+# Specific port listener for backend (8918 -> 444)
+https://:444 {
+    tls internal {
+        on_demand
+    }
+    reverse_proxy backend:8000
+}
+}

config/README.md

@@ -75,14 +75,17 @@ Controls the Next.js frontend application behavior and PWA settings.
 | `pwa.app_name` | Display name of the PWA | `TFM aInventory` |
 
 ### network.yaml
-Defines host-side port mappings and SSL/CORS policies.
+**SINGLE SOURCE OF TRUTH (SSOT):** This is the master file for your server's network topology. All other domains (Backend CORS, Frontend API URL) are dynamically derived from these settings.
 
 | Variable | Description | Default |
 |----------|-------------|---------|
+| `application.server_ip` | **MASTER IP** of your server | `localhost` |
+| `application.cors_origins`| Extra allowed origins (Subnets/IPs) | - |
 | `ports.backend_port` | Host port for backend | `8916` |
 | `ports.frontend_port` | Host port for frontend | `8917` |
 | `ssl.ssl_enabled` | Enable HTTPS via Caddy | `true` |
-| `cors.allowed_origins` | List of allowed origins | `*` |
+
+> **Note:** You only need to change the IP address in **this file**. The system will automatically update the frontend's API URL and the backend's CORS policies upon restart.
 
 ### docker.yaml
 Resource limits and container orchestration settings.

config/backend.yaml.example

@@ -35,21 +35,8 @@ ai:
   # Environment: BACKEND_AI_FALLBACK_PROVIDER
   fallback_provider: "claude"
 
-  # Gemini API Key (obtain from https://aistudio.google.com/)
-  # Environment: BACKEND_AI_GEMINI_API_KEY or GEMINI_API_KEY
-  gemini_api_key: "your-gemini-api-key"
-
-  # Claude API Key (obtain from Anthropic Console)
-  # Environment: BACKEND_AI_CLAUDE_API_KEY or CLAUDE_API_KEY
-  claude_api_key: "your-claude-api-key"
-
 # --- Authentication & LDAP ---
 auth:
-  # JWT Secret Key (min 32 chars)
-  # Generate with: openssl rand -hex 32
-  # Environment: BACKEND_AUTH_JWT_SECRET_KEY or JWT_SECRET_KEY
-  jwt_secret_key: "change_me_in_production"
-
   # Enable LDAP Authentication?
   # Default: false
   # Environment: BACKEND_AUTH_LDAP_ENABLED or LDAP_ENABLED