feat: sincronizar scaffold completo del shape web-backend/python

Sincroniza el scaffold canónico desde templates/web-backend-python/ del
repo IDP. Reemplaza el placeholder mínimo previo (.gitea/workflows/ci.yaml,
README.md, .gitignore, catalog-info.yaml) por el scaffold completo
documentado en ADR-053 §3:

- code/ — FastAPI app con /health (db check), /metrics, /demo estático,
  middleware correlation_id, settings Pydantic, db.py con SQLAlchemy
- code/alembic/ — migración inicial vacía + env.py usando MIGRATION_DATABASE_URL
- code/tests/ — pytest + httpx TestClient (test_health, test_demo)
- helm/APP_NAME/ — chart con Deployment, Service, IngressRoute Traefik,
  NetworkPolicy, ServiceMonitor, Job alembic-upgrade como hook
  pre-upgrade,pre-install (backoffLimit: 0)
- coralware-shape.yaml — manifiesto v1alpha1 del contrato del shape
- claim-mariadb.yaml — AddonClaim declarativo (uso futuro ADR-052)
- catalog-info.yaml — entidad Backstage actualizada
- .gitea/workflows/APP_NAME-build.yaml — invoca reusable workflow ADR-038
  + job helm-deploy con KUBECONFIG_TENANT_B64

Placeholders __APP_NAME__, __TIER__, __TENANT_ID__, __TENANT_ID_NODASHES__
serán sustituidos server-side por repo-provisioner cuando materialice el
template para un tenant (pendiente — ADR-053 §11.5).

El openspec/ del golden path NO se sincroniza al repo Gitea (gobernanza
interna de Coralware).

Refs: ADR-052, ADR-053, poc-nexobms.md (PoC NexoBMS Demetrio).

.gitea/workflows/APP_NAME-build.yaml

@@ -0,0 +1,83 @@
+name: __APP_NAME__ — build & deploy
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'code/**'
+      - 'helm/**'
+      - '.gitea/workflows/__APP_NAME__-build.yaml'
+
+jobs:
+  # Tests + build + push a Harbor — patrón ADR-038 reusable workflow.
+  build:
+    uses: coralware/IDP/.gitea/workflows/_python-microservice.yaml@main
+    with:
+      service_name: __APP_NAME__
+      service_dir: code
+      uses_metrics: false
+      coverage_threshold: 80          # menor que el IDP interno (90); el dev sube cuando madure
+      trivy_exit_code: 0              # informacional en MVP; subir a 1 antes de producción
+      enforce_rollback: false         # rollout lo gestiona el job helm-deploy abajo
+
+  # Deploy al cluster del tenant — Helm upgrade --install con hook Alembic.
+  helm-deploy:
+    needs: build
+    runs-on: [self-hosted, linux/amd64]
+    container: alpine/helm:3.14.4
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install kubectl
+        run: apk add --no-cache kubectl
+
+      - name: Decodificar kubeconfig del tenant
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_TENANT_B64 }}
+        run: |
+          if [ -z "$KUBECONFIG_B64" ]; then
+            echo "ERROR: secret KUBECONFIG_TENANT_B64 no configurado en el proyecto Gitea."
+            echo "tenant-manager debe provisionarlo al crear el repo."
+            exit 1
+          fi
+          mkdir -p /root/.kube
+          echo "$KUBECONFIG_B64" | base64 -d > /root/.kube/config
+          chmod 600 /root/.kube/config
+
+      - name: Helm upgrade --install
+        env:
+          TENANT_ID: ${{ vars.TENANT_ID }}
+          TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
+          TENANT_TIER: ${{ vars.TENANT_TIER }}
+          IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
+        run: |
+          helm upgrade --install __APP_NAME__ ./helm/__APP_NAME__ \
+            --namespace tenant-${TENANT_ID_NODASHES}-apps \
+            --create-namespace \
+            --set image.tag=${IMAGE_TAG} \
+            --set tenantId=${TENANT_ID} \
+            --set tenantIdNodashes=${TENANT_ID_NODASHES} \
+            --set tier=${TENANT_TIER} \
+            --wait --timeout 5m
+
+      - name: Verificar rollout
+        env:
+          TENANT_ID_NODASHES: ${{ vars.TENANT_ID_NODASHES }}
+        run: |
+          kubectl -n tenant-${TENANT_ID_NODASHES}-apps \
+            rollout status deploy/__APP_NAME__ --timeout=3m
+
+      - name: Smoke check post-deploy
+        env:
+          INGRESS_HOST: __APP_NAME__-${{ vars.TENANT_ID_NODASHES }}.apps.coralware.cloud
+        run: |
+          for i in $(seq 1 12); do
+            if wget -q -O - --timeout=10 "https://${INGRESS_HOST}/health" | grep -q '"status":"ok"'; then
+              echo "Smoke OK: /health responde 200 con db:up"
+              exit 0
+            fi
+            echo "Intento ${i}/12 — /health aún no responde, esperando 5s…"
+            sleep 5
+          done
+          echo "ERROR: /health no respondió 200 dentro del timeout"
+          exit 1