Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell

New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.

- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
  SECURITY rewritten for the server with the requirement ID table, DEPLOY,
  stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
  healthcheck. Settings from the environment with secret files. Stack guard
  (test never points at VISUAL production). Security headers and CSP.
  Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
  hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
  index only), compose base, proxy overlay for npm_default, CI overlay,
  postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
  self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
  database checks pass, 77 server tests pass against PostgreSQL.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

Dockerfile

@@ -0,0 +1,104 @@
+# syntax=docker/dockerfile:1.7
+#
+# Packet Station image. One image runs the app, the worker, migrations and doctor.
+# Build:  docker build --build-arg PS_BUILD=sha-<sha> -t gt.pescoinc.biz/spencerm/packetstation:sha-<sha> .
+# No password is ever passed at build time. Secrets arrive at run time as compose file secrets.
+
+ARG PYTHON_IMAGE=python:3.12-slim-bookworm
+ARG NODE_IMAGE=node:22-bookworm-slim
+
+# ---------------------------------------------------------------------------
+# Stage 1: frontend. Vite build into frontend/dist.
+# ---------------------------------------------------------------------------
+FROM ${NODE_IMAGE} AS frontend
+WORKDIR /src/frontend
+# Lockfile first so the npm ci layer is cached until dependencies change.
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci --no-audit --no-fund
+COPY frontend/ ./
+RUN npm run build
+
+# ---------------------------------------------------------------------------
+# Stage 2: builder. Python venv in /opt/venv with every dependency and the package.
+# ---------------------------------------------------------------------------
+FROM ${PYTHON_IMAGE} AS builder
+ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PYTHONDONTWRITEBYTECODE=1
+# PESCO's private index on Gitea. It serves visualkit, mfileskit and their dependencies only.
+ARG PESCO_INDEX_URL=https://gt.pescoinc.biz/api/packages/spencerm/pypi/simple/
+RUN python -m venv /opt/venv
+ENV PATH=/opt/venv/bin:$PATH
+WORKDIR /src
+
+# Public dependencies from PyPI.
+COPY server/requirements.txt server/requirements.txt
+RUN pip install -r server/requirements.txt
+
+# PESCO libraries from the Gitea index only. Always --index-url, never --extra-index-url,
+# so a public package with the same name can never be picked instead.
+COPY server/requirements-pesco.txt server/requirements-pesco.txt
+RUN pip install --index-url "${PESCO_INDEX_URL}" -r server/requirements-pesco.txt
+
+# The package itself. Dependencies are already in the venv.
+COPY pyproject.toml README* ./
+COPY server/ server/
+RUN pip install --no-deps . \
+ && pip check
+
+# ---------------------------------------------------------------------------
+# Stage 3: runtime.
+# ---------------------------------------------------------------------------
+FROM ${PYTHON_IMAGE} AS runtime
+
+# ODBC Driver 18 from Microsoft's Debian 12 repository, plus tini and tzdata.
+# curl and gnupg are only needed to fetch the signing key, so they are removed again.
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends curl gnupg ca-certificates; \
+    curl -fsSL https://packages.microsoft.com/keys/microsoft.asc \
+      | gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg; \
+    echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft-prod.gpg] https://packages.microsoft.com/debian/12/prod bookworm main" \
+      > /etc/apt/sources.list.d/microsoft-prod.list; \
+    apt-get update; \
+    ACCEPT_EULA=Y apt-get install -y --no-install-recommends \
+      msodbcsql18 unixodbc tini tzdata ca-certificates; \
+    apt-get purge -y --auto-remove curl gnupg; \
+    rm -rf /var/lib/apt/lists/*; \
+    odbcinst -q -d -n "ODBC Driver 18 for SQL Server"
+
+# Service user. Group 10001 matches the host secret files (root:10001 0440).
+RUN groupadd -g 10001 ps \
+ && useradd -u 10001 -g 10001 -r -M -d /app -s /usr/sbin/nologin ps
+
+COPY --from=builder /opt/venv /opt/venv
+COPY --from=frontend /src/frontend/dist /app/static
+COPY --chmod=0755 docker/entrypoint.sh /app/entrypoint.sh
+# Guard against CRLF line endings from a Windows checkout.
+RUN sed -i 's/\r$//' /app/entrypoint.sh
+
+# /data/assets is a named volume. Docker copies this ownership into a new volume on first use.
+# /backups is mounted read-only into the worker; it only needs to exist.
+RUN mkdir -p /data/assets /backups \
+ && chown 10001:10001 /data/assets \
+ && chmod 0750 /data/assets
+
+ARG PS_BUILD=dev
+ENV PATH=/opt/venv/bin:$PATH \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PS_BUILD=${PS_BUILD} \
+    STATIC_DIR=/app/static \
+    ASSETS_DIR=/data/assets \
+    BACKUP_DIR=/backups
+LABEL org.opencontainers.image.title="packetstation" \
+      org.opencontainers.image.source="https://gt.pescoinc.biz/spencerm/packetstation" \
+      org.opencontainers.image.version="${PS_BUILD}" \
+      biz.pescoinc.packetstation.build="${PS_BUILD}"
+
+WORKDIR /app
+USER ps
+EXPOSE 8000
+# No HEALTHCHECK here. Compose sets one per service (app and worker check different things).
+ENTRYPOINT ["tini", "--", "/app/entrypoint.sh"]
+CMD ["app"]