Refactor configuration and security features for improved development experience

- Updated the .env.example file to reflect a development environment setup with enhanced secret key requirements and local host settings.
- Modified the Docker Compose configuration to enhance security with read-only settings and no-new-privileges options.
- Updated requirements.txt to pin package versions for better dependency management.
- Enhanced the FastAPI application to include dynamic OpenAPI and documentation URLs based on the environment.
- Implemented session versioning in JWT tokens to improve security and user session management.
- Added new validation for user roles and password strength in schemas.
- Improved email sending logic to handle recipient lists more robustly and added logging for SMTP operations.
- Updated dashboard and profile templates to reflect new features and improve user experience.

app/services/config_store.py

@@ -1,17 +1,29 @@
 from sqlalchemy.orm import Session
 
+from app.core.secrets_crypto import decrypt_secret, encrypt_secret
 from app.models.system import AppConfig
 
+SECRET_CONFIG_KEYS = frozenset({"smtp.password"})
+
 
 def get_config(db: Session, key: str, default: str = "") -> str:
     row = db.query(AppConfig).filter(AppConfig.key == key).first()
-    return row.value if row else default
+    if not row:
+        return default
+    if key in SECRET_CONFIG_KEYS:
+        return decrypt_secret(row.value)
+    return row.value
 
 
 def set_config(db: Session, key: str, value: str) -> None:
+    stored = encrypt_secret(value) if key in SECRET_CONFIG_KEYS else value
     row = db.query(AppConfig).filter(AppConfig.key == key).first()
     if row:
-        row.value = value
+        row.value = stored
     else:
-        db.add(AppConfig(key=key, value=value))
+        db.add(AppConfig(key=key, value=stored))
     db.commit()
+
+
+def has_secret_config(db: Session, key: str) -> bool:
+    return db.query(AppConfig).filter(AppConfig.key == key).first() is not None