feat: Operational hardening — healthcheck, config refactor, requirements lock

- Add GET /health route (DB + Redis ping, 200/503) with Dockerfile HEALTHCHECK directive
- Replace config.py stub with real pydantic BaseSettings reading directly from env vars;
  remove external config file mount from docker-compose
- Add requirements.lock (pip freeze snapshot for bit-identical builds)
- Untrack config.py globally but allow app/config.py via .gitignore negation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Dockerfile

@@ -21,6 +21,11 @@ RUN pip install --no-cache-dir -r /tmp/requirements.txt
 # Create a reference of actual installed versions
 RUN pip freeze >> /tmp/aether_fastapi_requirements_current.txt
 
-# The application source is mounted as a volume in docker-compose.yml 
+# Docker health check — verifies DB + Redis connectivity via the /health route.
+# Interval/timeout tuned for Gunicorn startup time.
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+    CMD curl -f http://localhost/health || exit 1
+
+# The application source is mounted as a volume in docker-compose.yml
 # for real-time development, but we set the default command here.
 CMD ["gunicorn", "--conf", "/conf/gunicorn_fastapi_conf.py"]