fix(dev): bootstrap config.json + secrets and unblock test container

[KrishnaSuravarapu]

Problem

On a fresh checkout, local make dev / make build / make test fail with two errors — both caused by gitignored files that CI creates but local bootstrap didn't:

Container	Error	Root cause
dev (web)	FileNotFoundError: 'config.json'	Dockerfile bakes config.json, but the .:/srv/code/dev bind mount (docker-compose.yml:15) shadows it with the host dir, which has no local config.json.
test	pluggy PluginValidationError: Plugin 'pylama'	pylama's pytest11 plugin uses pytest_collect_file(path, ...), an arg removed in pytest 9. CI worked around it with -p no:pylama; the Docker/Makefile pytest invocations never got the fix.

Changes

• scripts/bootstrap_secrets.sh (new) — idempotently creates secrets/*.env from samples with a consistent MYSQL_ROOT_PASSWORD across files. Honors MYSQL_ROOT_PASSWORD / APP_TOKEN env overrides for deterministic runs (e.g. CI/debugging) before falling back to reuse-existing, then random.
• Makefile — new idempotent setup_config target that materializes config.json from its sample; wired (with setup_secrets) into setup, setup_mounts, dev, and build.
• pytest.ini — added -p no:pylama to addopts so the fix applies to every pytest invocation (test-container CMD + make test), not just CI. Standalone python -m pylama linting is unaffected.

Verification

• make setup_config creates config.json, and is a no-op on re-run (idempotent).
• dev container boots past config load and serves — HTTP 302 on http://localhost:8000 (redirect to auth).
• python -m pytest --co inside the container collects 115 tests with no PluginValidationError.

Notes / follow-up

• config.json stays gitignored — only bootstrapped locally.
• .github/workflows/unit-tests.yml can now drop its inline -p no:pylama (redundant with pytest.ini) — left in place for now as belt-and-suspenders; happy to remove if preferred.

🤖 Generated with Claude Code