lazyflat: combined alert + apply behind authenticated web UI

Three isolated services (alert scraper, apply HTTP worker, web UI+DB)
with argon2 auth, signed cookies, CSRF, rate-limited login, kill switch,
apply circuit breaker, audit log, and strict CSP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

alert/settings.py

@@ -0,0 +1,26 @@
+import sys
+from os import getenv
+from dotenv import load_dotenv
+
+load_dotenv()
+
+
+def _required(key: str) -> str:
+    val = getenv(key)
+    if not val:
+        print(f"missing required env var: {key}", file=sys.stderr)
+        sys.exit(1)
+    return val
+
+
+LANGUAGE: str = getenv("LANGUAGE", "en")
+TIME_INTERVALL: int = int(getenv("SLEEP_INTERVALL", "60"))
+
+# web backend: alert POSTs discovered flats here
+WEB_URL: str = getenv("WEB_URL", "http://web:8000")
+INTERNAL_API_KEY: str = _required("INTERNAL_API_KEY")
+
+# secrets
+GMAPS_API_KEY: str = _required("GMAPS_API_KEY")
+BERLIN_WOHNEN_USERNAME: str = _required("BERLIN_WOHNEN_USERNAME")
+BERLIN_WOHNEN_PASSWORD: str = _required("BERLIN_WOHNEN_PASSWORD")