Add ISCIII Beacon Podman rootless deployment

[magdasmat]

Summary

This PR applies the validated ISCIII Beacon deployment on top of the current BU-ISCIII/main branch.

The branch contains a single commit with the changes required to deploy Beacon using rootless Podman in the ISCIII-CIBER infrastructure.

Main changes

• Adds a rootless Podman deployment based on docker-compose.yml and .env.
• Adds .env.example with placeholders and no credentials.
• Updates Beacon and Admin UI configuration for the current Beacon structure.
• Updates Admin UI entry type handling to read the YAML configuration files.
• Adds the MongoDB permissions implementation used in the ISCIII deployment.
• Fixes Admin UI handling of Beacon security levels.
• Uses the upstream ghcr.io/ega-archive/beacon-template-ui:main image.
• Adds the Apache reverse proxy configuration with two virtual hosts: the Beacon UI (beaconaf-isciiiciber.isciiides.es) and an API-only host (apibeacon-isciiiciber.isciiides.es).
• Removes the beacon-ri-tools and phenopackets-to-BFF services. Dataset and variant ingestion runs from a separate impact-tools installation.
• Adds deploy/fix_permissions.sh to prepare bind mounts, ACLs and SELinux permissions.
• Adds the deployment and maintenance guide in docs/LEAME.md.

Dataset permissions in MongoDB

• Adds MongoPermissions in beacon/permissions/plugins.py, reading from the datasetsPermissions collection instead on datasets_permissions.yml from filesystem, and switches the active plugin in beacon/permissions/__main__.py.

Note: beacon/conf/datasets/datasets_conf.yml must still exist. beacon/validator/configuration.py reads it at startup to validate that its keys are isTest/isSynthetic and its values boolean. In this deployment the dataset flags live in the datasetsConf collection, written by impact-tools at ingestion time.

Admin UI

• adminui/adminbackend/forms/entry_types.py: reads entry type configuration from beacon/models/ga4gh/beacon_v2_default_model/conf/entry_types/*.yml. The previous code opened beacon/conf/<entry_type>.py, which no longer exists in this version.
• adminui/start.sh: removes reset_db and makemigrations. reset_db dropped and recreated the database on every container start, which is incompatible with the persistent SQLite volume added here. migrate --skip-checks decouples applying migrations from validating the full application; runserver performs the system checks immediately afterwards.
• adminui/templates/general_configuration/permits.html: wraps the granularity and security level radios in labels, without an enclosing label those inputs cannot be selected.
• adminui/adminbackend/settings.py and urls.py: ALLOWED_HOSTS, FORCE_SCRIPT_NAME and static file serving for the /admin-ui/ subpath.
• adminui/Dockerfile: reorders the build so that requirements.txt is copied before the application code, letting Docker reuse the dependency layer when only source files change. Uses npm ci instead of npm install for reproducible builds from the lockfile, and updates ENV KEY=VALUE and AS to the current syntax to silence building warnings.

Known limitations

• @permission_required('adminclient.can_see_view') is commented out in the Admin UI views.
• adminui/adminclient/migrations/* is git-ignored. With makemigrations removed from start.sh, a clean checkout has no migrations for the adminclient app.

Validation

The deployment has been validated on the ISCIII VM using rootless Podman.

The following workflows were tested:

• Full stack startup and recreation.
• Beacon API access through Apache.
• Template UI queries against the Beacon API.
• Admin UI authentication and configuration updates.
• Dataset configuration and permissions.
• Rootless Podman permissions after recreating the stack.
• Apache routes for the API, Admin UI, Template UI, Keycloak and Mongo Express.

No local .env file, credentials, private keys, database files or generated application builds are included in this PR.