feat: stabilize API startup and lifecycle management

- Refactor server initialization to separate concerns and improve error handling.
- Implement centralized environment validation using Zod.
- Introduce database, Redis, and queue lifecycle management.
- Add health check endpoints for liveness and readiness.
- Enhance error handling middleware for better response structure.
- Implement rate limiting for API endpoints.
- Add request ID middleware for traceability.
- Create Sequelize CLI configuration and baseline migration for schema management.
- Establish CI workflow with Gitea for testing and syntax checks.
- Document foundational changes and migration strategy in PHASE_0_FOUNDATION_STABILIZATION.md.
- Add Docker Compose configuration for local development and testing.
- Implement unit and integration tests for critical functionality.

.env.sample

@@ -1,53 +1,60 @@
-# App Details
-APP_NAME=
+# Required for API and worker startup
+APP_NAME=ZUMRI
+NODE_ENV=development
+PORT=3070
+FRONTEND_URL=http://localhost:3000
+TRUST_PROXY=0
 
-# Database configuration variables
-DB_HOST = 
-DB_USER = 
-DB_PASSWORD = 
-DB_NAME = 
-DB_PORT = 
+DB_HOST=localhost
+DB_PORT=3306
+DB_NAME=zumri
+DB_USER=zumri
+DB_PASSWORD=replace_with_local_database_password
+MYSQL_ROOT_PASSWORD=replace_with_local_root_password
 
-# Redis configuration variables
 REDIS_HOST=localhost
 REDIS_PORT=6379
+REDIS_PASSWORD=replace_with_local_redis_password
 
-# JWT secret key
-JWT_SECRET = your_jwt_secret_key_here
-JWT_EXPIRES_IN =1d
+# Use separate randomly generated values of at least 32 characters.
+JWT_SECRET=replace_with_a_random_value_at_least_32_chars
+REFRESH_TOKEN_SECRET=replace_with_a_different_random_32_char_value
+JWT_EXPIRES_IN=15m
+REFRESH_TOKEN_DAYS=7d
 
-# AWS S3 configuration
-AWS_ACCESS_KEY_ID=your_aws_access_key_id_here
-AWS_SECRET_ACCESS_KEY=your_aws_secret_access_key_here
-AWS_REGION=your_aws_region_here
-AWS_S3_BUCKET_NAME=your_aws_bucket_name_here
+# Runtime controls
+RUN_CRON=false
+CACHE=true
+JSON_BODY_LIMIT=1mb
+API_RATE_LIMIT_WINDOW_MS=900000
+API_RATE_LIMIT_MAX=300
+SENSITIVE_RATE_LIMIT_WINDOW_MS=900000
+SENSITIVE_RATE_LIMIT_MAX=20
+SHUTDOWN_TIMEOUT_MS=10000
 
-# Mail configuration
+# Optional email feature
+ENABLE_MAIL=false
 MAIL_HOST=
 MAIL_PORT=587
 MAIL_USER=
 MAIL_PASS=
-MAIL_SECURE=false 
+MAIL_SECURE=false
 MAIL_FROM=
 
-# Documentation access credentials
+# Optional S3 feature
+ENABLE_S3=false
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_REGION=
+AWS_S3_BUCKET_NAME=
+
+# Optional documentation login
 DOCS_USER=
 DOCS_PASS=
 
-# Admin email for receiving notifications
+# Optional application configuration
 MANAGER_EMAIL=
-
-# Caching configuration
-CACHE=true
-
-# Application environment
-NODE_ENV=development
-
-# User default password
 DEFAULT_PASSWORD=
-
-# Frontend URL for CORS
-FRONTEND_URL=http://localhost:3000
-
-# Puppeteer executable path (if needed, otherwise Puppeteer will use the bundled Chromium)
-PUPPETEER_EXECUTABLE_PATH = C:\Users\User\.cache\puppeteer\chrome-headless-shell\win64-142.0.7444.162\chrome-headless-shell-win64\chrome-headless-shell.exe
+PASSWORD_RESET_TTL_SECONDS=900
+EMAIL_VERIFICATION_TTL_SECONDS=86400
+PUPPETEER_EXECUTABLE_PATH=