lazyflat: combined alert + apply behind authenticated web UI

Three isolated services (alert scraper, apply HTTP worker, web UI+DB)
with argon2 auth, signed cookies, CSRF, rate-limited login, kill switch,
apply circuit breaker, audit log, and strict CSP.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apply/paths.py

@@ -0,0 +1,19 @@
+from pathlib import Path
+import logging
+
+logger = logging.getLogger("flat-apply")
+
+def get_project_root() -> Path:
+    """Returns the root directory of the project."""
+    current_path = Path(__file__).resolve()
+
+    for parent in current_path.parents:
+        if (parent / ".git").exists():
+            return parent
+        if (parent / "requirements.txt").exists():
+            return parent
+
+    return current_path.parent.parent
+
+ROOT_DIR = get_project_root()
+TRANSLATIONS_FILE = ROOT_DIR / "translations.toml"