feat: implement pdfGUI React + FastAPI migration

Backend (FastAPI):
- Core configuration and database setup
- SQLAlchemy models for all 17 tables (users, projects, fittings, phases, atoms, datasets, calculations, parameters, constraints, files, history)
- Pydantic schemas for request/response validation
- Service layer wrapping original pdfGUI logic unchanged:
  - FittingService (refinement workflows)
  - StructureService (crystal structure operations)
  - DatasetService (PDF data handling)
  - ConstraintService (formula parsing/evaluation)
  - FileService (upload/parsing)
  - AuthService (JWT + bcrypt authentication)
- REST API endpoints for all CRUD operations
- Main FastAPI application with CORS

Frontend (React):
- TypeScript types for JSON-driven forms and charts
- DynamicForm component with Zod validation
- Wizard component for multi-step workflows
- PDFPlot component using Plotly
- JSON form schemas (fitting wizard)
- Chart template configurations
- API client service with auth interceptors
- Zustand auth store with persist
- React Router setup with protected routes

Tests:
- Pytest configuration with fixtures
- Numerical regression tests matching original pdfGUI:
  - Grid interpolation (15 decimal precision)
  - Constraint evaluation
  - Structure operations
  - Dataset operations
  - Project loading
- API endpoint tests

Documentation:
- Complete requirements gap analysis (10-pass review)
- 70% overall completion with clear path to 100%

Author: claude

pdfgui-migration/backend/app/__init__.py

@@ -0,0 +1,2 @@
+"""pdfGUI Migration Backend - FastAPI Application"""
+__version__ = "1.0.0"

pdfgui-migration/backend/app/api/__init__.py

@@ -0,0 +1 @@
+"""API router configuration."""

pdfgui-migration/backend/app/api/deps.py

@@ -0,0 +1,53 @@
+"""API dependencies."""
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from sqlalchemy.orm import Session
+from ..core.database import get_db
+from ..core.security import decode_token
+from ..models.user import User
+from uuid import UUID
+
+security = HTTPBearer()
+
+
+def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    db: Session = Depends(get_db)
+) -> User:
+    """Get current authenticated user from JWT token."""
+    token = credentials.credentials
+
+    payload = decode_token(token)
+    if not payload:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token"
+        )
+
+    if payload.get("type") != "access":
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token type"
+        )
+
+    user_id = payload.get("sub")
+    if not user_id:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid token payload"
+        )
+
+    user = db.query(User).filter(User.id == UUID(user_id)).first()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="User not found"
+        )
+
+    if not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="User account is disabled"
+        )
+
+    return user

pdfgui-migration/backend/app/api/v1/__init__.py

@@ -0,0 +1,12 @@
+"""API v1 router."""
+from fastapi import APIRouter
+from .endpoints import auth, projects, fittings, phases, datasets, files
+
+api_router = APIRouter()
+
+api_router.include_router(auth.router, prefix="/auth", tags=["auth"])
+api_router.include_router(projects.router, prefix="/projects", tags=["projects"])
+api_router.include_router(fittings.router, prefix="/fittings", tags=["fittings"])
+api_router.include_router(phases.router, prefix="/phases", tags=["phases"])
+api_router.include_router(datasets.router, prefix="/datasets", tags=["datasets"])
+api_router.include_router(files.router, prefix="/files", tags=["files"])

pdfgui-migration/backend/app/api/v1/endpoints/__init__.py

@@ -0,0 +1 @@
+"""API endpoints."""

pdfgui-migration/backend/app/api/v1/endpoints/auth.py

@@ -0,0 +1,79 @@
+"""Authentication endpoints."""
+from fastapi import APIRouter, Depends, HTTPException, status, Request
+from sqlalchemy.orm import Session
+from ....core.database import get_db
+from ....schemas.user import UserCreate, UserLogin, UserResponse, Token, TokenRefresh
+from ....services.auth_service import AuthService
+
+router = APIRouter()
+
+
+@router.post("/register", response_model=UserResponse, status_code=status.HTTP_201_CREATED)
+def register(user_data: UserCreate, db: Session = Depends(get_db)):
+    """Register a new user."""
+    auth_service = AuthService(db)
+    try:
+        user = auth_service.create_user(
+            email=user_data.email,
+            password=user_data.password,
+            first_name=user_data.first_name,
+            last_name=user_data.last_name
+        )
+        return user
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+
+@router.post("/login", response_model=Token)
+def login(
+    credentials: UserLogin,
+    request: Request,
+    db: Session = Depends(get_db)
+):
+    """Authenticate user and get tokens."""
+    auth_service = AuthService(db)
+    user = auth_service.authenticate(credentials.email, credentials.password)
+
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid credentials"
+        )
+
+    if not user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="User account is disabled"
+        )
+
+    tokens = auth_service.create_session(
+        user,
+        ip_address=request.client.host if request.client else None,
+        user_agent=request.headers.get("user-agent")
+    )
+
+    return tokens
+
+
+@router.post("/refresh", response_model=Token)
+def refresh_token(token_data: TokenRefresh, db: Session = Depends(get_db)):
+    """Refresh access token."""
+    auth_service = AuthService(db)
+    tokens = auth_service.refresh_access_token(token_data.refresh_token)
+
+    if not tokens:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid refresh token"
+        )
+
+    return tokens
+
+
+@router.post("/logout")
+def logout(token_data: TokenRefresh, db: Session = Depends(get_db)):
+    """Logout and invalidate session."""
+    auth_service = AuthService(db)
+    success = auth_service.logout(token_data.refresh_token)
+
+    return {"success": success}