feat: FastAPI console with dashboard, Pulp client, healthz (stages 0-1)

- config: PULP_* env + 사내 CA(verify=) 대응
- pulp_client: Basic Auth get/post/patch, status/list_repos/get_version
- BFF 라우트: GET / (대시보드), GET /repos (조각), GET /healthz
- views: Pulp JSON → 표시 모델 (GPG 검증 배지 3단계, 요약 집계)
- HTMX + Jinja 템플릿, vendored pico.css/htmx.js (CDN 의존 0)
- 브라우저는 Pulp 직접 호출 안 함 — 모두 BFF 경유 (스펙 §2)
- 테스트: pulp_client(respx), 라우트(dependency_overrides), views 순수함수

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_pulp_client.py

@@ -0,0 +1,39 @@
+import httpx
+import pytest
+import respx
+
+from app.config import get_settings, tls_verify
+from app.pulp_client import PulpClient
+from tests.conftest import PULP_TEST_URL
+
+
+def test_tls_verify_prefers_ca_file(monkeypatch):
+    monkeypatch.setenv("PULP_CA_FILE", "/etc/ssl/boknet-ca.pem")
+    monkeypatch.setenv("PULP_VERIFY_TLS", "false")
+    get_settings.cache_clear()
+    assert tls_verify(get_settings()) == "/etc/ssl/boknet-ca.pem"
+
+
+def test_tls_verify_falls_back_to_bool():
+    # conftest: CA 비어있음, VERIFY_TLS=false
+    assert tls_verify(get_settings()) is False
+
+
+@respx.mock
+def test_status_returns_json():
+    route = respx.get(f"{PULP_TEST_URL}/pulp/api/v3/status/").mock(
+        return_value=httpx.Response(200, json={"online": True, "versions": []})
+    )
+    with PulpClient() as pulp:
+        data = pulp.status()
+    assert route.called
+    assert data == {"online": True, "versions": []}
+
+
+@respx.mock
+def test_get_raises_on_http_error():
+    respx.get(f"{PULP_TEST_URL}/pulp/api/v3/status/").mock(
+        return_value=httpx.Response(503)
+    )
+    with PulpClient() as pulp, pytest.raises(httpx.HTTPStatusError):
+        pulp.status()