Initial commit: Uruk Prize Platform architecture, backend core, mobile app, gateway caller & deployment pipeline

backend/config/app.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+    'name' => getenv('APP_NAME') ?: 'Uruk International Prize',
+    'env' => getenv('APP_ENV') ?: 'development',
+    'debug' => (bool)(getenv('APP_DEBUG') ?: true),
+    'url' => getenv('APP_URL') ?: 'http://localhost:8000',
+    'secret' => getenv('APP_SECRET') ?: 'uruk_default_super_secret_signing_key_32_chars_min',
+    'timezone' => 'Asia/Baghdad',
+    'currency' => 'IQD',
+    'membership_price_usd' => 100.00,
+    'membership_price_iqd' => 132000.00,
+    'membership_duration_years' => 2,
+];

backend/config/database.php

@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+    'host' => getenv('DB_HOST') ?: '127.0.0.1',
+    'port' => (int)(getenv('DB_PORT') ?: 3306),
+    'database' => getenv('DB_DATABASE') ?: 'uruk_prize_db',
+    'username' => getenv('DB_USERNAME') ?: 'root',
+    'password' => getenv('DB_PASSWORD') ?: '',
+    'charset' => 'utf8mb4',
+    'collation' => 'utf8mb4_unicode_ci',
+    'options' => [
+        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
+        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+        PDO::ATTR_EMULATE_PREPARES => false,
+        PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci",
+    ],
+];

backend/config/redis.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+    'host' => getenv('REDIS_HOST') ?: '127.0.0.1',
+    'port' => (int)(getenv('REDIS_PORT') ?: 6379),
+    'password' => getenv('REDIS_PASSWORD') ?: null,
+    'database' => (int)(getenv('REDIS_DB') ?: 0),
+    'timeout' => 2.0,
+    'prefix' => 'uruk:',
+];

backend/config/security.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+    // Header names required for every authenticated request
+    'headers' => [
+        'user_id' => 'HTTP_X_USER_ID',
+        'fingerprint' => 'HTTP_X_DEVICE_FINGERPRINT',
+        'timestamp' => 'HTTP_X_TIMESTAMP',
+        'nonce' => 'HTTP_X_NONCE',
+        'signature' => 'HTTP_X_SIGNATURE',
+    ],
+    // Time tolerance in seconds for anti-replay check
+    'timestamp_tolerance' => 120, // 2 minutes
+    // Dynamic QR token lifetime in seconds
+    'qr_token_lifetime' => 90, // 90 seconds rotation
+    // Encryption cipher
+    'cipher' => 'aes-256-gcm',
+    // Password hash algorithm
+    'password_algo' => defined('PASSWORD_ARGON2ID') ? PASSWORD_ARGON2ID : PASSWORD_BCRYPT,
+];