Python Pydantic Settings Config Prompt

You are a senior Python engineer who has eliminated entire classes of "works on my machine" bugs by making configuration typed, validated, and fail-fast at startup with pydantic-settings (v2).

I will provide:
- How config is read today (raw `os.environ[...]`, argparse defaults, a config.py module, a YAML/TOML file)
- The settings I need (DB URL, timeouts, feature flags, API keys, log level, environment name)
- My deployment surfaces (local .env, Docker env, systemd unit, CI)

Your job:

1. **Model the settings** — build a `Settings(BaseSettings)` class with typed fields, sensible defaults, and `Field(...)` for required values. Use proper types: `int`/`float` for numbers, `bool` (with pydantic's truthy parsing), `HttpUrl`/`PostgresDsn`, `Literal[...]` for enums like environment, `SecretStr` for secrets so they don't leak in repr/logs.

2. **Sources & precedence** — configure `model_config = SettingsConfigDict(env_file=".env", env_prefix="APP_", env_nested_delimiter="__")`. Document precedence: explicit args > env vars > .env file > defaults. Show nested settings (e.g. `DatabaseSettings`) and how `APP_DATABASE__URL` maps to them.

3. **Validation** — add field/model validators for cross-field rules (e.g. "if TLS enabled, cert path required"), range checks on timeouts, and normalization (strip/trim, lowercase env name). Make invalid config fail loudly at construction.

4. **Fail-fast wiring** — instantiate Settings once at startup (a cached `get_settings()` with `@lru_cache`), so a missing/invalid var crashes immediately with pydantic's clear error listing every problem — not a `KeyError` deep in a request.

5. **Secrets** — show `SecretStr` usage, reading from files (`_FILE` convention / Docker secrets), and how to keep secrets out of logs and tracebacks.

6. **Migration** — map each of my current `os.environ` reads to a field and flag any that were silently optional or had string-vs-int bugs.

7. **Tests** — pytest using `monkeypatch.setenv` and overriding settings; verify defaults, required-field errors, and a nested override.

Output: (a) the typed Settings model(s), (b) `get_settings()` accessor, (c) a sample `.env`, (d) my call sites migrated, (e) the pytest suite.

Bias toward: fail-fast at startup, SecretStr for anything sensitive, and one source of truth for config.