feat(infra): add ServerState, MongoDB, auth middleware, and DaisyUI theme toggle

Introduce centralized ServerState (Arc-wrapped, Box::leaked configs) loaded
once at startup, replacing per-request dotenvy/env::var calls across all
server functions. Add MongoDB Database wrapper with connection pooling.
Add tower middleware that gates all /api/ server function endpoints behind
session authentication (401 for unauthenticated callers, except check-auth).
Fix DaisyUI theme toggle to use certifai-dark/certifai-light theme names
and replace hardcoded hex colors in main.css with CSS variables.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -1,16 +1,80 @@
-# Keycloak Configuration (frontend public client)
+# ============================================================================
+# CERTifAI Dashboard - Environment Variables
+# ============================================================================
+# Copy this file to .env and fill in the values.
+# Variables marked [REQUIRED] must be set; others have sensible defaults.
+
+# ---------------------------------------------------------------------------
+# Keycloak Configuration (frontend public client) [REQUIRED]
+# ---------------------------------------------------------------------------
 KEYCLOAK_URL=http://localhost:8080
 KEYCLOAK_REALM=certifai
 KEYCLOAK_CLIENT_ID=certifai-dashboard
 
-# Application Configuration
+# Keycloak admin / service-account client (server-to-server calls) [OPTIONAL]
+KEYCLOAK_ADMIN_CLIENT_ID=
+KEYCLOAK_ADMIN_CLIENT_SECRET=
+
+# ---------------------------------------------------------------------------
+# Application Configuration [REQUIRED]
+# ---------------------------------------------------------------------------
 APP_URL=http://localhost:8000
 REDIRECT_URI=http://localhost:8000/auth/callback
 ALLOWED_ORIGINS=http://localhost:8000
 
-# SearXNG meta-search engine
+# ---------------------------------------------------------------------------
+# MongoDB [OPTIONAL - defaults shown]
+# ---------------------------------------------------------------------------
+MONGODB_URI=mongodb://localhost:27017
+MONGODB_DATABASE=certifai
+
+# ---------------------------------------------------------------------------
+# SearXNG meta-search engine [OPTIONAL - default: http://localhost:8888]
+# ---------------------------------------------------------------------------
 SEARXNG_URL=http://localhost:8888
 
-# Ollama LLM instance (used for article summarization and chat)
-OLLAMA_URL=http://mac-mini-von-benjamin-2:11434
-OLLAMA_MODEL=qwen3:30b-a3b
+# ---------------------------------------------------------------------------
+# Ollama LLM instance [OPTIONAL - defaults shown]
+# ---------------------------------------------------------------------------
+OLLAMA_URL=http://localhost:11434
+OLLAMA_MODEL=llama3.1:8b
+
+# ---------------------------------------------------------------------------
+# LLM Providers (comma-separated list) [OPTIONAL]
+# ---------------------------------------------------------------------------
+LLM_PROVIDERS=ollama
+
+# ---------------------------------------------------------------------------
+# SMTP (transactional email) [OPTIONAL]
+# ---------------------------------------------------------------------------
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USERNAME=
+SMTP_PASSWORD=
+SMTP_FROM_ADDRESS=
+
+# ---------------------------------------------------------------------------
+# Stripe billing [OPTIONAL]
+# ---------------------------------------------------------------------------
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
+STRIPE_PUBLISHABLE_KEY=
+
+# ---------------------------------------------------------------------------
+# LangChain / LangGraph / Langfuse [OPTIONAL]
+# ---------------------------------------------------------------------------
+LANGCHAIN_URL=
+LANGGRAPH_URL=
+LANGFUSE_URL=
+
+# ---------------------------------------------------------------------------
+# Vector database [OPTIONAL]
+# ---------------------------------------------------------------------------
+VECTORDB_URL=
+
+# ---------------------------------------------------------------------------
+# S3-compatible object storage [OPTIONAL]
+# ---------------------------------------------------------------------------
+S3_URL=
+S3_ACCESS_KEY=
+S3_SECRET_KEY=