feat(backend): add FastAPI backend — procurement, inventory domain, Casdoor auth, PM arrival endpoints

backend/app/utils/security.py

@@ -0,0 +1,14 @@
+"""Placeholder auth: no middleware logic, only a header read for `actor` attribution."""
+from fastapi import Request
+
+
+def get_actor(request: Request) -> str | None:
+    """Extract the bearer token (if any) to attribute quote_events.actor.
+
+    This is the reserved placeholder from the contract — no authentication
+    or authorization is enforced yet.
+    """
+    auth = request.headers.get("Authorization")
+    if auth and auth.lower().startswith("bearer "):
+        return auth[7:].strip() or None
+    return None