feat: add Django project scaffold, configuration and container

Environment-variable configuration that fails fast, database-only health
check, JSON request logs with a request id, security headers with a strict
CSP, and a multi-stage non-root Docker image with compose file. Ticket 1.1.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

portal/tests/test_config.py

@@ -0,0 +1,72 @@
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from portal.config.env import ConfigError, load_config
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_valid_environment_uses_safe_defaults(valid_env):
+    config = load_config(valid_env)
+    assert config.debug is False
+    assert config.log_level == "INFO"
+    assert config.default_timezone == "Europe/Berlin"
+    assert config.trusted_proxies == []
+    assert config.allowed_hosts == ["testserver"]
+
+
+def test_every_problem_is_listed_and_no_value_leaks(valid_env):
+    secret = "short-secret"
+    env = {
+        **valid_env,
+        "SECRET_KEY": secret,
+        "LOG_LEVEL": "loud",
+        "DEBUG": "maybe",
+        "TRUSTED_PROXIES": "not-an-ip",
+        "DEFAULT_TIMEZONE": "Nowhere/Land",
+    }
+    del env["ALLOWED_HOSTS"]
+    with pytest.raises(ConfigError) as info:
+        load_config(env)
+    message = str(info.value)
+    for name in (
+        "SECRET_KEY",
+        "ALLOWED_HOSTS",
+        "LOG_LEVEL",
+        "DEBUG",
+        "TRUSTED_PROXIES",
+        "DEFAULT_TIMEZONE",
+    ):
+        assert name in message
+    assert secret not in message
+
+
+def test_missing_data_dir_is_reported(valid_env, tmp_path):
+    with pytest.raises(ConfigError, match="DATA_DIR"):
+        load_config({**valid_env, "DATA_DIR": str(tmp_path / "missing")})
+
+
+def test_process_exits_nonzero_naming_both_variables(tmp_path):
+    env = {k: v for k, v in os.environ.items() if k not in ("SECRET_KEY", "LOG_LEVEL")}
+    env.update(
+        ALLOWED_HOSTS="testserver",
+        DATA_DIR=str(tmp_path),
+        LOG_LEVEL="loud",
+        DJANGO_SETTINGS_MODULE="portal.config.settings",
+    )
+    result = subprocess.run(  # noqa: S603
+        [sys.executable, "manage.py", "check"],
+        cwd=ROOT,
+        env=env,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert result.returncode != 0
+    assert "SECRET_KEY" in result.stderr
+    assert "LOG_LEVEL" in result.stderr
+    assert "Traceback" not in result.stderr