Local Python Health Data Vault — FastAPI + SQLite, laptop only, no cloud

I need a personal medical-record web app that runs only on my laptop at http://127.0.0.1. No hosting, no domain, no AWS, no patient-portal login.
I am a non-coder. If I cannot start the app from your README on Windows 11, the job is not done.
Read the three attached files before bidding. They are the spec:

REQUIREMENTS.md
V1-DEVELOPER-BRIEF.md
V1-ACCEPTANCE.md

Ship dummy data only (John Doe / Doctor Doe1). Do not ask for real medical files.
This v1 app must also be a clean template for a later product: friends/family use, a commercial vault, or a hosted system. Build v1 as a small local app, but keep the data model and permissions clean. Do not hard-wire features to “one SQLite file on one laptop” in a way that cannot be moved to Postgres and hosted files later. Do not build that hosted version now.
What it is
One owner stores records from Canada, the US, and Portugal. Doctors can log in, view non-hidden records, and add new ones. Nobody edits a stored record in place. Real records can be hidden, not deleted. The owner may purge seed/test rows only; that purge is audit-logged.
Tabs — do not add other top-level tabs

Home — allergies, current meds, latest labs; hidden-count for owner only
Personal Info — Allergies, Medications, Conditions, Family History, Immunizations on one page
Records — sub-tabs Labs, Imaging, Misc
Notes — typed text
Audit log — owner only

Family History is a data section, not family user accounts.
Minimum fields

Allergies: substance, reaction, onset date, notes
Medications: name, dose, frequency, start date, active yes/no
Conditions: name, diagnosed date, status
Family History: relative, condition, notes
Immunizations: vaccine, date, notes
Labs: test name, value, unit, range, collected date, optional file
Imaging: study date, modality (CT / MRI / US), body region, file (pdf / jpg / png only)
Misc: title, document date, file
Notes: title, text, date

Shared on file records: source country CA / US / PT, hidden-from-doctors, who created it, when, supersedes_id.
Must include

Bulk upload of at least 10 files at once (pdf, jpg, png, doc, docx). Owner and doctor may use it. User picks Labs / Imaging / Misc (default Misc). Reject .dcm and keep importing the rest.
Hashed passwords, session timeout, lockout, owner can invite and disable a doctor
AES-256 on stored file bytes; key only in .env
Bind 127.0.0.1 only
README: how to run on Windows 11, dummy logins, backup = copy data/ and .env to a USB drive
English UI

Do not build in the base job
Cloud, public or LAN bind, email, phone app, MyChart or any clinic-site login, DICOM viewer, .dcm ingest, family logins, Portuguese UI, paid APIs, hosted auth (Auth0 / Cognito / Clerk), certification claims.
If you have a good extra idea, put it in the bid as an optional extra with its own price. We can negotiate extras. Do not build them into the base job unless I approve a change order.
Stack
Python + FastAPI + SQLite + simple HTML templates.

React / Next only if you explain why and still hit the hour range.
Keep routes, tables, and file storage behind simple interfaces so SQLite and the local file folder can be replaced later without rewriting the product. No abstraction theatre. No cloud “for later.”

Acceptance
Done when every box in V1-ACCEPTANCE.md passes on my Windows 11 laptop from your README, offline.

Milestones

App starts on 127.0.0.1, login works, five tabs open — 20%
Personal Info + Records sub-tabs + dummy seed data — 25%
Bulk loader, hide/audit, AES-256, hashed auth — 35%
Full acceptance list + README I can follow — 20%

How to deliver
Zip or private git repo. Source + README + .env.example + dummy seed. No live server. data/ and .env gitignored.

In your bid include

Fixed price for the base spec
Hours estimate
Confirmation it will run on Windows 11
Two examples of FastAPI or similar apps you have shipped
A short restatement of: localhost only, no portal login, no delete of real records
Optional extras, each with its own price

I will not award on lowest price alone. I will award on a clear reading of the spec and a plan I can run without you sitting beside me!