feat: backend project setup with FastAPI structure and dependencies

- Create directory structure per IMPLEMENTATION_PLAN.md Section 12
- Add requirements.txt with FastAPI, SQLAlchemy, CrewAI, etc.
- Add core/config.py for environment variable configuration
- Add core/database.py for SQLite connection
- Add core/security.py for password hashing and JWT
- Add FastAPI app entry point (main.py) with all API routers
- Add Uvicorn runner (run.py)
- Add API route stubs (auth, bots, backtest, simulate, config)
- Add db/models.py with SQLAlchemy models
- Add db/schemas.py with Pydantic schemas
- Add service stubs (ai_agent, backtest, simulate engines)
- Add .env.example with all required environment variables
- Verify server starts correctly

src/backend/app/core/config.py

@@ -0,0 +1,25 @@
+from pydantic_settings import BaseSettings
+from functools import lru_cache
+
+
+class Settings(BaseSettings):
+    DATABASE_URL: str = "sqlite:///./data/app.db"
+    SECRET_KEY: str
+    JWT_ALGORITHM: str = "HS256"
+    ACCESS_TOKEN_EXPIRE_MINUTES: int = 1440
+    MINIMAX_API_KEY: str
+    MINIMAX_MODEL: str = "MiniMax-Text-01"
+    AVE_API_KEY: str
+    AVE_API_PLAN: str = "free"
+    HOST: str = "0.0.0.0"
+    PORT: int = 8000
+    DEBUG: bool = False
+
+    class Config:
+        env_file = ".env"
+        extra = "allow"
+
+
+@lru_cache()
+def get_settings() -> Settings:
+    return Settings()

src/backend/app/core/database.py

@@ -0,0 +1,40 @@
+import os
+from sqlalchemy import create_engine, event
+from sqlalchemy.orm import sessionmaker, declarative_base
+from sqlalchemy.engine import Engine
+from .config import get_settings
+
+settings = get_settings()
+
+if settings.DATABASE_URL.startswith("sqlite"):
+    db_path = settings.DATABASE_URL.replace("sqlite:///", "")
+    os.makedirs(
+        os.path.dirname(db_path) if os.path.dirname(db_path) else ".", exist_ok=True
+    )
+
+    @event.listens_for(Engine, "connect")
+    def set_sqlite_pragma(dbapi_conn, connection_record):
+        cursor = dbapi_conn.cursor()
+        cursor.execute("PRAGMA foreign_keys=ON")
+        cursor.close()
+
+
+engine = create_engine(
+    settings.DATABASE_URL,
+    connect_args={"check_same_thread": False}
+    if settings.DATABASE_URL.startswith("sqlite")
+    else {},
+    echo=settings.DEBUG,
+)
+
+SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+
+Base = declarative_base()
+
+
+def get_db():
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()

src/backend/app/core/security.py

@@ -0,0 +1,42 @@
+from datetime import datetime, timedelta
+from typing import Any, Optional
+from jose import jwt, JWTError
+from passlib.context import CryptContext
+from .config import get_settings
+
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+
+def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
+    to_encode = data.copy()
+    settings = get_settings()
+    if expires_delta:
+        expire = datetime.utcnow() + expires_delta
+    else:
+        expire = datetime.utcnow() + timedelta(
+            minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES
+        )
+    to_encode.update({"exp": expire})
+    encoded_jwt = jwt.encode(
+        to_encode, settings.SECRET_KEY, algorithm=settings.JWT_ALGORITHM
+    )
+    return encoded_jwt
+
+
+def verify_token(token: str) -> Optional[dict[str, Any]]:
+    settings = get_settings()
+    try:
+        payload = jwt.decode(
+            token, settings.SECRET_KEY, algorithms=[settings.JWT_ALGORITHM]
+        )
+        return payload
+    except JWTError:
+        return None
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return pwd_context.verify(plain_password, hashed_password)
+
+
+def get_password_hash(password: str) -> str:
+    return pwd_context.hash(password)