feat : init Central project — Symfony 8 + Nuxt 4 + Docker starter

Same architecture as Lesstime: API Platform 4, JWT auth, @malio/layer-ui,
PostgreSQL 16, Docker Compose (ports 8083/3003/5436), dark mode theme.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

config/packages/security.yaml

@@ -0,0 +1,61 @@
+security:
+    role_hierarchy:
+        ROLE_ADMIN: [ROLE_USER]
+
+    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
+    password_hashers:
+        Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
+
+    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
+    providers:
+        app_user_provider:
+            entity:
+                class: App\Entity\User
+                property: username
+
+    firewalls:
+        dev:
+            # Ensure dev tools and static assets are always allowed
+            pattern: ^/(_profiler|_wdt|assets|build)/
+            security: false
+        login:
+            pattern: ^/login_check
+            stateless: true
+            provider: app_user_provider
+            login_throttling:
+                max_attempts: 5
+                interval: '1 minute'
+            json_login:
+                check_path: /login_check
+                username_path: username
+                password_path: password
+                success_handler: lexik_jwt_authentication.handler.authentication_success
+                failure_handler: lexik_jwt_authentication.handler.authentication_failure
+        api:
+            pattern: ^/api
+            stateless: true
+            provider: app_user_provider
+            jwt: ~
+            logout:
+                path: /api/logout
+                target: /login
+                enable_csrf: false
+                delete_cookies:
+                    BEARER:
+                        path: /
+
+    # Note: Only the *first* matching rule is applied
+    access_control:
+        - { path: ^/login_check, roles: PUBLIC_ACCESS }
+        - { path: ^/api/docs, roles: PUBLIC_ACCESS }
+        - { path: ^/api/version, roles: PUBLIC_ACCESS, methods: [ GET ] }
+        - { path: ^/api, roles: IS_AUTHENTICATED_FULLY }
+
+when@test:
+    security:
+        password_hashers:
+            Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface:
+                algorithm: auto
+                cost: 4 # Lowest possible value for bcrypt
+                time_cost: 3 # Lowest possible value for argon
+                memory_cost: 10 # Lowest possible value for argon