feat: implement pngx-controller with Gitea CI/CD deployment

- Full FastAPI sync engine: master→replica document sync via paperless REST API
- Web UI: dashboard, replicas, logs, settings (Jinja2 + HTMX + Pico CSS)
- APScheduler background sync, SSE live log stream, Prometheus metrics
- Fernet encryption for API tokens at rest
- pngx.env credential file: written on save, pre-fills forms on load
- Dockerfile with layer-cached uv build, Python healthcheck
- docker-compose with host networking for Tailscale access
- Gitea Actions workflow: version bump, secret injection, docker compose deploy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/crypto.py

@@ -0,0 +1,21 @@
+from cryptography.fernet import Fernet
+
+
+def make_fernet(key: str) -> Fernet:
+    return Fernet(key.encode() if isinstance(key, str) else key)
+
+
+def encrypt(value: str, key: str) -> str:
+    return make_fernet(key).encrypt(value.encode()).decode()
+
+
+def decrypt(encrypted: str, key: str) -> str:
+    return make_fernet(key).decrypt(encrypted.encode()).decode()
+
+
+def is_valid_fernet_key(key: str) -> bool:
+    try:
+        Fernet(key.encode() if isinstance(key, str) else key)
+        return True
+    except Exception:
+        return False