refactor: replace config.yml with .env for all configuration

All settings (auth credentials, scanner ranges, status_checker interval)
now live in a single .env file via pydantic-settings. config.yml and
config.yml.example are deleted.

- Settings: add auth_username, auth_password_hash, scanner_ranges,
  status_checker_interval; add load_overrides()/save_overrides() for
  persisting runtime changes to data/scan_config.json
- auth.py: read credentials directly from settings
- scan.py: read ranges/interval from settings; write-back via save_overrides()
- scheduler.py: read interval directly from settings
- main.py: call settings.load_overrides() at startup
- docker-compose.yml: remove config.yml volume mount, add new env vars
- conftest.py: set settings fields directly instead of writing a temp config.yml

backend/tests/test_auth.py

@@ -1,16 +1,7 @@
-from unittest.mock import patch
-
-import pytest
 from httpx import AsyncClient
 
 
-@pytest.fixture
-def mock_credentials():
-    with patch("app.api.routes.auth._load_credentials", return_value=("admin", "$2b$12$o/LWyvmBc978CNpSsHxcveXN0WqjAGW/gBR0.U.HURWbaYD3GCDqS")):
-        yield
-
-
-async def test_login_success(client: AsyncClient, mock_credentials):
+async def test_login_success(client: AsyncClient):
     res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "admin"})
     assert res.status_code == 200
     data = res.json()
@@ -18,12 +9,12 @@ async def test_login_success(client: AsyncClient, mock_credentials):
     assert data["token_type"] == "bearer"
 
 
-async def test_login_wrong_password(client: AsyncClient, mock_credentials):
+async def test_login_wrong_password(client: AsyncClient):
     res = await client.post("/api/v1/auth/login", json={"username": "admin", "password": "wrong"})
     assert res.status_code == 401
 
 
-async def test_login_wrong_username(client: AsyncClient, mock_credentials):
+async def test_login_wrong_username(client: AsyncClient):
     res = await client.post("/api/v1/auth/login", json={"username": "notadmin", "password": "admin"})
     assert res.status_code == 401