Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell

New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.

- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
  SECURITY rewritten for the server with the requirement ID table, DEPLOY,
  stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
  healthcheck. Settings from the environment with secret files. Stack guard
  (test never points at VISUAL production). Security headers and CSP.
  Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
  hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
  index only), compose base, proxy overlay for npm_default, CI overlay,
  postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
  self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
  database checks pass, 77 server tests pass against PostgreSQL.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

docs/SCHEMA.md

@@ -0,0 +1,51 @@
+# Packet Station schema
+
+Status: planned, phases 1 to 3. This is a stub. The full DDL lands here as the migrations are written. See [PLAN.md](PLAN.md), "Schema".
+
+## Conventions
+
+Identity bigints, except users, keyed on the AD objectGUID. Postgres enums for workflow states. Every timestamp is timestamptz in UTC. Soft delete uses removed_at, removed_by and removed_reason. Append-only tables give the app role insert and select only, plus a trigger that refuses updates and deletes.
+
+## Database roles
+
+A superuser for bootstrap, the migrate role `ps_migrate` (owns the schema, runs migrations) and the app role `ps_app`. The plan's deployment section also names a worker role `ps_worker`. Phase 0 creates only the first three; whether the worker gets its own role is still to settle.
+
+## Identity (phase 1)
+
+users, user_roles, sessions, devices, user_pins, signin_attempts, signatures.
+
+## Organisation (phase 2)
+
+departments (code and slug immutable), stations, user_station_limits.
+
+## Projects and units (phase 2)
+
+projects, project_aliases, project_renumbers, units.
+
+## Packets (phase 2)
+
+The packet header and its child tables: work orders, pages, BOM lines, shorts, welds, heat tags, stages, warehouse, transitions, Q.C., seals, log.
+
+## Change orders (phases 2 and 3)
+
+change_orders, co_items, co_required_depts, co_verifications.
+
+## Documents (phases 2, 4 and 6)
+
+assets, packet_docs, qc_docs, ITPs.
+
+## Audit, settings, jobs (phases 1 and 3)
+
+audit_events with a hash chain, settings, job_requests, job_runs, job_schedule, worker_heartbeat.
+
+## Notifications (phase 9)
+
+Rules, recipients, exclusions, outbox, sent log, state.
+
+## VISUAL and drawing caches (phase 3)
+
+visual_batches, visual_rows, visual_materials, order links, labor, change rows, ignored work orders, resource map, drawing_lookups.
+
+## Versioning
+
+packets.version goes up in every transaction that touches the packet or a child. It is the ETag and the NOTIFY payload.