init: 从 /root/zikai 根目录迁入

把原本散落在 /root/zikai 的 FastAPI 服务整理到 server/ 子目录，
开启独立 git 与 venv。运行时数据（config.yaml / keys / uploads）
按 .gitignore 留在工作目录但不入仓。

config.example.yaml

@@ -0,0 +1,44 @@
+# Application runtime configuration. Copy from config.example.yaml and fill in real values.
+# All secrets (DB password, SFTP user hashes/keys) live here - keep it out of version control.
+
+server:
+  host: 127.0.0.1      # bind address; Apache proxies f.zikai.wang -> here
+  port: 6867           # internal port; MUST match the Apache ProxyPass target
+  workers: 1           # uvicorn worker count
+
+database:
+  host: 127.0.0.1
+  port: 3306
+  user: zikai_filesvc
+  password: "CHANGE_ME"        # generated/overwritten by setup.sh provisioning
+  database: zikai_filesvc      # independent new database (not shared with other apps)
+  pool_size: 5
+  pool_recycle: 1800
+
+storage:
+  upload_dir: ./uploads        # where uploaded files are written (shared with SFTP)
+  chunk_bytes: 1048576         # 1 MiB streaming chunk for HTTP upload (keeps RAM flat)
+  sha256_on_upload: true       # compute sha256 while streaming to disk
+
+sftp:
+  enabled: true
+  host: 0.0.0.0                # SFTP cannot go through Apache's HTTP proxy, expose directly
+  port: 2022                   # open this port in the firewall for external SFTP clients
+  host_key_path: ./keys/ssh_host_ed25519_key
+  authorized_keys_path: ./keys/authorized_keys
+  # Each user may authenticate by password (bcrypt hash) and/or by a public key listed
+  # in authorized_keys_path. Generate a bcrypt hash with:
+  #   python -c "import bcrypt;print(bcrypt.hashpw(b'yourpass',bcrypt.gensalt()).decode())"
+  users:
+    - username: uploader
+      password_hash: "CHANGE_ME_BCRYPT_HASH"
+      # public keys for this user go in keys/authorized_keys (one key per line, OpenSSH format)
+
+docs:
+  # /docs, /redoc and /openapi.json are protected with HTTP Basic Auth.
+  # Password is stored as plaintext here -- this file is root-owned and lives
+  # only on this server; comparison is constant-time. No hashing needed.
+  enabled: true
+  username: admin
+  password: "CHANGE_ME"
+  realm: "zikai docs"