feat: scaffold Django multi-tenant project with 5 of 9 apps

Phase 1 scaffolding: config/, core/, base models, AES-256-GCM phone encryption, enums mirror

apps.tenant: Tenant + Domain (django-tenants)

apps.org: 11 models (OrgUnit hierarchy, Staff, audit logs)

apps.account: 4 models (UserAccount as AUTH_USER_MODEL, login/password tracking)

apps.permission: 7 models (RBAC + overrides + datascope + append-only changelog)

apps.region: 5 models (District, BusinessArea, MetroLine, MetroStation, School)

All migrations generated, manage.py check passes

.env.example

@@ -0,0 +1,38 @@
+# ============================================================
+# Fonrey .env.example
+# Copy to .env and fill real values. Never commit .env.
+# Generate PHONE_ENCRYPTION_KEY:
+#   python -c 'import secrets,base64; print(base64.b64encode(secrets.token_bytes(32)).decode())'
+# Generate SECRET_KEY:
+#   python -c 'import secrets; print(secrets.token_urlsafe(50))'
+# ============================================================
+
+# ----- Django -----
+SECRET_KEY=
+DEBUG=True
+DJANGO_SETTINGS_MODULE=config.settings.development
+ALLOWED_HOSTS=localhost,127.0.0.1
+
+# ----- Database (PostgreSQL 16) -----
+DB_NAME=fonrey
+DB_USER=fonrey
+DB_PASSWORD=fonrey
+DB_HOST=db
+DB_PORT=5432
+
+# ----- Redis (Cache + Sessions + Celery) -----
+REDIS_URL=redis://redis:6379/0
+CELERY_BROKER_URL=redis://redis:6379/1
+
+# ----- Cloudflare R2 (S3-compatible) -----
+R2_ENDPOINT_URL=https://<account_id>.r2.cloudflarestorage.com
+R2_ACCESS_KEY_ID=
+R2_SECRET_ACCESS_KEY=
+R2_BUCKET_NAME=media
+R2_CUSTOM_DOMAIN=
+
+# ----- Sentry (production only) -----
+SENTRY_DSN=
+
+# ----- PII Encryption (AES-256-GCM, 32 bytes base64) -----
+PHONE_ENCRYPTION_KEY=