feat: BreakPilot PWA - Full codebase (clean push without large binaries)

All services: admin-v2, studio-v2, website, ai-compliance-sdk,
consent-service, klausur-service, voice-service, and infrastructure.
Large PDFs and compiled binaries excluded via .gitignore.

.env.staging

@@ -0,0 +1,113 @@
+# ============================================
+# BreakPilot PWA - STAGING Environment
+# ============================================
+# Usage: cp .env.staging .env
+# Or: ./scripts/env-switch.sh staging
+# ============================================
+
+# ============================================
+# Environment Identifier
+# ============================================
+ENVIRONMENT=staging
+COMPOSE_PROJECT_NAME=breakpilot-staging
+
+# ============================================
+# HashiCorp Vault (Secrets Management)
+# ============================================
+# In staging, still use dev token but with staging secrets path
+VAULT_ADDR=http://localhost:8200
+VAULT_DEV_TOKEN=breakpilot-staging-token
+
+# ============================================
+# Database (Separate from Dev!)
+# ============================================
+POSTGRES_USER=breakpilot
+POSTGRES_PASSWORD=staging_secure_password_change_this
+POSTGRES_DB=breakpilot_staging
+DATABASE_URL=postgres://breakpilot:staging_secure_password_change_this@postgres:5432/breakpilot_staging?sslmode=disable
+
+# Synapse DB (Matrix)
+SYNAPSE_DB_PASSWORD=synapse_staging_secure_123
+
+# ============================================
+# Authentication
+# ============================================
+# Staging secrets - more secure than dev, but not production
+JWT_SECRET=staging-jwt-secret-32chars-change-me-now
+JWT_REFRESH_SECRET=staging-refresh-secret-32chars-secure
+
+# ============================================
+# Service URLs (Staging - Different Ports)
+# ============================================
+FRONTEND_URL=http://localhost:8001
+BACKEND_URL=http://localhost:8001
+CONSENT_SERVICE_URL=http://localhost:8091
+BILLING_SERVICE_URL=http://localhost:8093
+SCHOOL_SERVICE_URL=http://localhost:8094
+KLAUSUR_SERVICE_URL=http://localhost:8096
+WEBSITE_URL=http://localhost:3001
+
+# ============================================
+# E-Mail (Still Mailpit for Safety)
+# ============================================
+# Mailpit catches all emails - no accidental sends to real users
+SMTP_HOST=mailpit
+SMTP_PORT=1025
+SMTP_USERNAME=
+SMTP_PASSWORD=
+SMTP_FROM_NAME=BreakPilot Staging
+SMTP_FROM_ADDR=staging@breakpilot.local
+
+# ============================================
+# MinIO (Object Storage)
+# ============================================
+MINIO_ROOT_USER=breakpilot_staging
+MINIO_ROOT_PASSWORD=staging_minio_secure_123
+MINIO_ENDPOINT=localhost:9002
+
+# ============================================
+# Qdrant (Vector DB)
+# ============================================
+QDRANT_URL=http://localhost:6335
+
+# ============================================
+# API Keys (Test Keys for Staging)
+# ============================================
+# Use test/sandbox API keys here
+ANTHROPIC_API_KEY=
+ANTHROPIC_DEFAULT_MODEL=claude-sonnet-4-20250514
+ANTHROPIC_ENABLED=false
+
+VAST_API_KEY=
+VAST_INSTANCE_ID=
+CONTROL_API_KEY=
+VAST_AUTO_SHUTDOWN=true
+VAST_AUTO_SHUTDOWN_MINUTES=30
+
+VLLM_BASE_URL=
+VLLM_ENABLED=false
+
+# ============================================
+# Embedding Configuration
+# ============================================
+EMBEDDING_BACKEND=local
+
+# ============================================
+# Stripe (Billing - Test Mode)
+# ============================================
+# Use Stripe TEST keys (sk_test_...)
+STRIPE_SECRET_KEY=
+STRIPE_PUBLISHABLE_KEY=
+STRIPE_WEBHOOK_SECRET=
+
+# ============================================
+# Debug Settings (Reduced in Staging)
+# ============================================
+DEBUG=false
+GIN_MODE=release
+LOG_LEVEL=info
+
+# ============================================
+# Jitsi (Video Conferencing)
+# ============================================
+JITSI_PUBLIC_URL=http://localhost:8444