refactor: replace config.yml with .env for all configuration

All settings (auth credentials, scanner ranges, status_checker interval)
now live in a single .env file via pydantic-settings. config.yml and
config.yml.example are deleted.

- Settings: add auth_username, auth_password_hash, scanner_ranges,
  status_checker_interval; add load_overrides()/save_overrides() for
  persisting runtime changes to data/scan_config.json
- auth.py: read credentials directly from settings
- scan.py: read ranges/interval from settings; write-back via save_overrides()
- scheduler.py: read interval directly from settings
- main.py: call settings.load_overrides() at startup
- docker-compose.yml: remove config.yml volume mount, add new env vars
- conftest.py: set settings fields directly instead of writing a temp config.yml

backend/app/api/routes/auth.py

@@ -1,6 +1,5 @@
 import hmac
 
-import yaml
 from fastapi import APIRouter, HTTPException, status
 from pydantic import BaseModel
 
@@ -20,20 +19,12 @@ class TokenResponse(BaseModel):
     token_type: str = "bearer"
 
 
-def _load_credentials() -> tuple[str, str]:
-    with open(settings.config_path) as f:
-        cfg = yaml.safe_load(f)
-    auth = cfg.get("auth", {})
-    return auth.get("username", "admin"), auth.get("password_hash", "")
-
-
 @router.post("/login", response_model=TokenResponse)
 async def login(body: LoginRequest) -> TokenResponse:
-    username, password_hash = _load_credentials()
     # Always run both checks to prevent timing-based username enumeration.
     # hmac.compare_digest is constant-time; verify_password (bcrypt) always runs.
-    username_ok = hmac.compare_digest(body.username, username)
-    password_ok = verify_password(body.password, password_hash)
+    username_ok = hmac.compare_digest(body.username, settings.auth_username)
+    password_ok = verify_password(body.password, settings.auth_password_hash)
     if not username_ok or not password_ok:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
     token = create_access_token(body.username)