Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell

New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.

- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
  SECURITY rewritten for the server with the requirement ID table, DEPLOY,
  stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
  healthcheck. Settings from the environment with secret files. Stack guard
  (test never points at VISUAL production). Security headers and CSP.
  Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
  hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
  index only), compose base, proxy overlay for npm_default, CI overlay,
  postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
  self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
  database checks pass, 77 server tests pass against PostgreSQL.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

deploy/ci/make-secrets.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Make throwaway secrets for a CI or local end-to-end run of compose.ci.yaml.
+# Every value is random and new on each run. Nothing here is ever committed:
+# deploy/ci/ci-secrets/ and deploy/ci/ci-backups/ are gitignored and dockerignored.
+# Also makes an empty CA bundle placeholder (phase 1 swaps in the Samba DC's CA)
+# and an empty backup folder for the worker's read-only mount.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+out="$here/ci-secrets"
+backups="$here/ci-backups"
+
+umask 077
+mkdir -p "$out" "$backups"
+
+rand() {
+  # 32 random bytes as hex. No newline, so the file holds exactly the value.
+  od -An -N32 -tx1 /dev/urandom | tr -d ' \n'
+}
+
+for name in \
+  postgres_superuser_password postgres_migrate_password postgres_app_password \
+  visualkit_password mfileskit_password ldap_bind_password \
+  session_key seal_key
+do
+  rand > "$out/$name"
+done
+
+: > "$out/ca.pem"
+
+# CI only: the containers run as uid 10001 and uid 999 (postgres), not as the runner's
+# user, so the throwaway files are world-readable. Production files are root:10001 0440.
+chmod 0755 "$out" "$backups"
+chmod 0444 "$out"/*
+
+echo "make-secrets: wrote $(ls "$out" | wc -l) files to $out"