Phase 0: backend + frontend scaffold, single-binary build

Implements the Pansy v1 scaffold (epic #20, phase 0).

#1 Backend: Go module (pure-Go, builds with CGO_ENABLED=0), env config,
   gin server with slog + recovery + /api/v1/healthz, modernc SQLite store
   with WAL/busy_timeout/foreign_keys pragmas, embedded numbered-migration
   runner, full initial schema (users, sessions, gardens, garden_shares,
   garden_objects, plants, plantings), domain structs + sentinel errors,
   graceful shutdown.

#2 Frontend: Vite + React 19 + TS (strict) + Tailwind 4 + TanStack
   Router/Query, typed /api/v1 fetch wrapper (ApiError carries status +
   body so later issues can read 409 conflict rows), dev proxy /api -> :8080,
   responsive app shell with stub pages for all five routes.

#3 Single binary: //go:embed of the web build with a committed placeholder,
   SPA fallback (deep links, immutable asset caching, JSON 404 for unmatched
   /api and missing assets), Makefile (web/build/dev/test), README quickstart
   + env var table.

Verified: go build/vet/test clean (CGO off); binary migrates idempotently and
serves healthz; web tsc + build clean; integrated binary serves the SPA, deep
links, and correct cache headers; app mounts and navigates all five routes at
desktop and 375px widths.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/config/config.go

@@ -0,0 +1,136 @@
+// Package config loads pansy's runtime configuration from the environment.
+//
+// Every value has a sensible default so `pansy` runs with zero configuration
+// for local use; production deployments override via PANSY_* env vars. Auth
+// values (local + OIDC) are plumbed here now and consumed by the auth issues
+// (#4 local, #5 OIDC).
+package config
+
+import (
+	"log/slog"
+	"os"
+	"strconv"
+	"strings"
+)
+
+// Registration gates local self-service signup.
+const (
+	RegistrationOpen   = "open"
+	RegistrationClosed = "closed"
+)
+
+// Config is the fully-resolved runtime configuration.
+type Config struct {
+	// Port is the TCP port the HTTP server listens on (PANSY_PORT, default 8080).
+	Port int
+	// DBPath is the SQLite database file path (PANSY_DB, default ./pansy.db).
+	DBPath string
+	// BaseURL is the externally-visible base URL, used to derive the OIDC
+	// redirect URI and absolute links (PANSY_BASE_URL). Empty in bare local dev.
+	BaseURL string
+	// Registration is "open" or "closed"; gates POST /auth/register for local
+	// accounts (PANSY_REGISTRATION, default open). OIDC JIT provisioning ignores
+	// this — the IdP gates access.
+	Registration string
+	// LocalAuth enables argon2id username/password auth (PANSY_LOCAL_AUTH,
+	// default true). Set false for pure-Authentik deployments.
+	LocalAuth bool
+	// OIDC holds the optional OpenID Connect provider settings.
+	OIDC OIDCConfig
+	// TrustedProxies is the set of proxy CIDRs/IPs gin trusts for client IP
+	// resolution (PANSY_TRUSTED_PROXIES, comma-separated). Empty trusts none.
+	TrustedProxies []string
+}
+
+// OIDCConfig holds the OpenID Connect provider settings (Authentik is the
+// primary IdP). Consumed by #5.
+type OIDCConfig struct {
+	Issuer       string // PANSY_OIDC_ISSUER — discovery base URL
+	ClientID     string // PANSY_OIDC_CLIENT_ID
+	ClientSecret string // PANSY_OIDC_CLIENT_SECRET
+	ButtonLabel  string // PANSY_OIDC_BUTTON_LABEL — login-page button text
+}
+
+// Enabled reports whether enough OIDC config is present to attempt discovery.
+func (o OIDCConfig) Enabled() bool {
+	return o.Issuer != "" && o.ClientID != ""
+}
+
+// RegistrationOpen reports whether local self-service signup is allowed.
+func (c *Config) RegistrationOpen() bool {
+	return c.Registration == RegistrationOpen
+}
+
+// Load reads configuration from the environment, applying defaults. It never
+// fails: invalid numeric/boolean values fall back to the default and are logged.
+func Load() *Config {
+	cfg := &Config{
+		Port:         envInt("PANSY_PORT", 8080),
+		DBPath:       envStr("PANSY_DB", "./pansy.db"),
+		BaseURL:      strings.TrimRight(envStr("PANSY_BASE_URL", ""), "/"),
+		Registration: envStr("PANSY_REGISTRATION", RegistrationOpen),
+		LocalAuth:    envBool("PANSY_LOCAL_AUTH", true),
+		OIDC: OIDCConfig{
+			Issuer:       envStr("PANSY_OIDC_ISSUER", ""),
+			ClientID:     envStr("PANSY_OIDC_CLIENT_ID", ""),
+			ClientSecret: envStr("PANSY_OIDC_CLIENT_SECRET", ""),
+			ButtonLabel:  envStr("PANSY_OIDC_BUTTON_LABEL", "Sign in with SSO"),
+		},
+		TrustedProxies: envList("PANSY_TRUSTED_PROXIES"),
+	}
+
+	if cfg.Registration != RegistrationOpen && cfg.Registration != RegistrationClosed {
+		slog.Warn("config: invalid PANSY_REGISTRATION, defaulting to open", "value", cfg.Registration)
+		cfg.Registration = RegistrationOpen
+	}
+
+	return cfg
+}
+
+func envStr(key, def string) string {
+	if v, ok := os.LookupEnv(key); ok && v != "" {
+		return v
+	}
+	return def
+}
+
+func envInt(key string, def int) int {
+	v, ok := os.LookupEnv(key)
+	if !ok || v == "" {
+		return def
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil {
+		slog.Warn("config: invalid int env, using default", "key", key, "value", v, "default", def)
+		return def
+	}
+	return n
+}
+
+func envBool(key string, def bool) bool {
+	v, ok := os.LookupEnv(key)
+	if !ok || v == "" {
+		return def
+	}
+	b, err := strconv.ParseBool(v)
+	if err != nil {
+		slog.Warn("config: invalid bool env, using default", "key", key, "value", v, "default", def)
+		return def
+	}
+	return b
+}
+
+func envList(key string) []string {
+	v, ok := os.LookupEnv(key)
+	if !ok || v == "" {
+		return nil
+	}
+	parts := strings.Split(v, ",")
+	out := make([]string, 0, len(parts))
+	for _, p := range parts {
+		if p = strings.TrimSpace(p); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}