feat: Flask API for encrypted records (CRUD + replay protection)

Exposes a ciphertext-only REST API: list/get/create/update/delete of
records as opaque base64 blobs. Enforces base64/size validation,
rejects duplicates, and uses patch-version checks server-side so
replayed or stale updates are refused. Includes run.py entry point
that enables TLS when certs/ are present. Verified via test client.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

run.py

@@ -0,0 +1,26 @@
+"""Dev/Prod entry point. Runs the Flask app, over TLS when certs exist."""
+
+import os
+import ssl
+
+from backend.app import app
+from backend import storage
+
+
+def main():
+    storage.init_db()
+
+    cert = os.path.join("certs", "cert.pem")
+    key = os.path.join("certs", "key.pem")
+
+    if os.path.exists(cert) and os.path.exists(key):
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        context.load_cert_chain(cert, key)
+        app.run(host="127.0.0.1", port=8443, ssl_context=context)
+    else:
+        print("WARNING: no certs/ found, running WITHOUT TLS (dev only!).")
+        app.run(host="127.0.0.1", port=5000)
+
+
+if __name__ == "__main__":
+    main()