Initial commit: CI Agent competitive-intelligence monitoring app

FastAPI + Celery + Next.js + Postgres/Redis app with company monitoring,
source collection, LLM-based change analysis, enrichment, and account
security (Turnstile, escalating lockout, email verification).

apps/api/app/models/system_secret.py

@@ -0,0 +1,24 @@
+"""A server-wide secret (e.g. Turnstile site key/secret), encrypted at rest
+(app/core/crypto.py). Unlike UserApiKey, this isn't scoped to a user - it's
+one value shared by the whole app, admin-editable from the Settings page
+instead of only via .env. When set,
+app/services/system_secret_service.py's get_effective_settings substitutes
+it in place of the server's global .env-configured value - see that module
+for the full fallback logic."""
+
+from __future__ import annotations
+
+from sqlalchemy import Enum, Text
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base, TimestampMixin, UUIDPrimaryKeyMixin
+from app.models.enums import SystemSecretKey
+
+
+class SystemSecret(Base, UUIDPrimaryKeyMixin, TimestampMixin):
+    __tablename__ = "system_secrets"
+
+    key: Mapped[SystemSecretKey] = mapped_column(
+        Enum(SystemSecretKey, native_enum=False, length=32), unique=True
+    )
+    encrypted_value: Mapped[str] = mapped_column(Text)