Initial commit: ImpactFlow Discovery + Google OAuth auth layer

Discovery service (pre-existing): FastAPI + async SQLAlchemy + Alembic +
SQLite + Anthropic, with a five-prompt static UI that produces an Enneagram
+ Ikigai profile.

Auth implementation (this change set) follows
Impact_Flow_Auth_Plan_OAuth.html, adapted to the discovery_conversation /
discovery_profile schema:

- app/auth.py: Google OAuth registration, JWT issue/decode, dual-auth
  dependency (Bearer JWT or X-API-Key), refresh-token hashing, domain
  allow-list, synthetic api-key-admin user
- app/tracking.py: ActivityTrackingMiddleware + log_activity helper;
  tags machine-to-machine calls source=mcp
- app/routers/auth.py: /api/auth/{login,callback,refresh,logout},
  /api/me, /api/me/{stats,sessions,sessions/{id}}
- app/routers/activity.py: /api/activity, /api/activity/summary,
  /api/admin/activity, plus prune_old_activity (90-day retention)
- app/routers/discovery.py: every route now user-scoped via the auth
  dependency; /discovery/profile/{user_id} -> /discovery/profile/me
- alembic/versions/002_add_auth.py: users, refresh_tokens, activity_log
- tests/test_auth.py: 8 tests covering 401 paths, X-API-Key admin
  resolution, JWT round-trip, admin gating, domain allow-list
- README.md: Authentication section, expanded env-var table, updated
  data-model and API-reference tables
- .env.example: new GOOGLE_*, JWT_*, IMPACTFLOW_API_KEY, CORS_*,
  ALLOWED_EMAIL_DOMAINS placeholders
- .gitignore: also exclude data/*.log

Tests: 19/19 pass (11 pre-existing + 8 new). smoke_test.py exercises the
full discovery flow under X-API-Key plus 401 paths, OAuth login redirect,
activity logging, and /api/me/stats.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/schemas.py

@@ -0,0 +1,67 @@
+"""Pydantic request/response models for the discovery API."""
+from datetime import datetime
+from typing import Optional
+
+from pydantic import BaseModel
+
+
+class StartResponse(BaseModel):
+    conversation_id: str
+
+
+class RespondRequest(BaseModel):
+    prompt_alive: str = ""
+    prompt_friction: str = ""
+    prompt_pull: str = ""
+    prompt_recognition: str = ""
+    prompt_future: str = ""
+
+
+class RespondResponse(BaseModel):
+    conversation_id: str
+    status: str
+
+
+class Confidence(BaseModel):
+    triad: Optional[str] = None
+    type: Optional[str] = None
+    variant: Optional[str] = None
+    ikigai: Optional[str] = None
+
+
+class ProfileResponse(BaseModel):
+    id: str
+    user_id: str
+    conversation_id: str
+    generated_at: datetime
+    triad: Optional[str] = None
+    probable_type: Optional[int] = None
+    wing: Optional[int] = None
+    instinctual_variant: Optional[str] = None
+    instinctual_stack: Optional[str] = None
+    love_summary: Optional[str] = None
+    strength_summary: Optional[str] = None
+    mission_summary: Optional[str] = None
+    vocation_summary: Optional[str] = None
+    overlap_narrative: Optional[str] = None
+    confidence: Optional[Confidence] = None
+    locked: bool = False
+    extraction_notes: Optional[str] = None
+
+
+class ConfirmResponse(BaseModel):
+    status: str
+
+
+class ConversationResponse(BaseModel):
+    id: str
+    user_id: str
+    started_at: datetime
+    completed_at: Optional[datetime] = None
+    prompt_alive: Optional[str] = None
+    prompt_friction: Optional[str] = None
+    prompt_pull: Optional[str] = None
+    prompt_recognition: Optional[str] = None
+    prompt_future: Optional[str] = None
+
+    model_config = {"from_attributes": True}