Core and plugin

QuantumTouch is composed of two Python packages. quantumtouch-core is a
Flask application framework, not a helper library. It owns the application
factory, the entire authentication and authorisation stack (API keys, sessions,
CSRF, rate limiting, account lockout, TLS and certificate lifecycle), the
settings store, the Prometheus exposition endpoint, the interactive API browser,
and the single-page-application static serve. quantumtouch-bng is a plugin
that supplies BNG-specific routes, settings validation, and metric content. The
plugin contains no authorisation logic of its own; it declares the role each
route requires and core enforces it.

The plugin registers one blueprint containing every route module. Core mounts
that blueprint at the base path /api/bng. Every path in this document,
except the controller passthrough, is that prefix plus the route's own rule.

Registering the blueprint is not a passive act — it starts three background
subsystems that produce much of what the API later returns: the metrics sampler
thread, the authentication and platform gauge collectors, and, when destinations
are configured, the audit shipper. All three are idempotent and all three are
suppressed under test.