feat: scaffold supabase multi-tenant backend

apps/api/src/core/config.ts

@@ -0,0 +1,37 @@
+import { DEFAULT_DATABASE_URL, DEFAULT_TENANT_SLUG, envList, envNumber, envString, loadDotenv } from '../../../../packages/config/src/index.js';
+
+export interface ApiConfig {
+  nodeEnv: string;
+  port: number;
+  databaseUrl: string;
+  defaultTenantSlug: string;
+  corsOrigins: string[];
+  authCodePepper: string;
+  authSessionSecret: string;
+  authSmsProvider: string;
+  authCodeTtlSeconds: number;
+  authSmsCooldownSeconds: number;
+  authSessionTtlSeconds: number;
+  platformAdminApiKey: string;
+  isProduction: boolean;
+}
+
+loadDotenv();
+
+const isProduction = envString('NODE_ENV', 'development') === 'production';
+
+export const config: ApiConfig = {
+  nodeEnv: envString('NODE_ENV', 'development'),
+  port: envNumber('PORT', 8787),
+  databaseUrl: envString('DATABASE_URL', DEFAULT_DATABASE_URL),
+  defaultTenantSlug: envString('DEFAULT_TENANT_SLUG', DEFAULT_TENANT_SLUG),
+  corsOrigins: envList('CORS_ORIGIN', '*'),
+  authCodePepper: envString('AUTH_CODE_PEPPER', 'development-code-pepper-change-me'),
+  authSessionSecret: envString('AUTH_SESSION_SECRET', 'development-session-secret-change-me'),
+  authSmsProvider: envString('AUTH_SMS_PROVIDER', 'mock'),
+  authCodeTtlSeconds: envNumber('AUTH_CODE_TTL_SECONDS', 300),
+  authSmsCooldownSeconds: envNumber('AUTH_SMS_COOLDOWN_SECONDS', 60),
+  authSessionTtlSeconds: envNumber('AUTH_SESSION_TTL_SECONDS', 60 * 60 * 24 * 7),
+  platformAdminApiKey: envString('PLATFORM_ADMIN_API_KEY', 'local-platform-admin-key'),
+  isProduction,
+};