Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell

New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.

- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
  SECURITY rewritten for the server with the requirement ID table, DEPLOY,
  stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
  healthcheck. Settings from the environment with secret files. Stack guard
  (test never points at VISUAL production). Security headers and CSP.
  Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
  hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
  index only), compose base, proxy overlay for npm_default, CI overlay,
  postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
  self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
  database checks pass, 77 server tests pass against PostgreSQL.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

frontend/src/lib/version.ts

@@ -0,0 +1,51 @@
+// Build version and API health. The server owns both endpoints.
+// The parsers are lenient on purpose: the server shape may grow, and a missing field must not break the page.
+import { api, request } from "../api/client";
+
+export interface VersionInfo {
+  /** Release or build version, for example "0.1.0" or "sha-abc1234". */
+  version: string;
+  /** Optional extra build detail, such as the commit or the PS_BUILD label. */
+  build?: string;
+}
+
+export interface HealthInfo {
+  ok: boolean;
+  /** Short status text from the server, or the error message. */
+  status: string;
+}
+
+function str(v: unknown): string | undefined {
+  return typeof v === "string" && v.trim() !== "" ? v.trim() : undefined;
+}
+
+export function parseVersion(raw: unknown): VersionInfo {
+  if (typeof raw === "string") return { version: str(raw) ?? "unknown" };
+  if (raw && typeof raw === "object") {
+    const o = raw as Record<string, unknown>;
+    const version = str(o.version) ?? str(o.build) ?? "unknown";
+    const build = str(o.build) ?? str(o.commit) ?? str(o.sha);
+    return build && build !== version ? { version, build } : { version };
+  }
+  return { version: "unknown" };
+}
+
+export async function fetchVersion(signal?: AbortSignal): Promise<VersionInfo> {
+  return parseVersion(await api.get<unknown>("/api/version", signal));
+}
+
+export async function fetchHealth(signal?: AbortSignal): Promise<HealthInfo> {
+  try {
+    const raw = await request<unknown>("/healthz", signal ? { signal } : {});
+    let status = "ok";
+    if (typeof raw === "string") status = str(raw) ?? status;
+    else if (raw && typeof raw === "object") status = str((raw as Record<string, unknown>).status) ?? status;
+    return { ok: true, status };
+  } catch (err) {
+    if (err instanceof DOMException && err.name === "AbortError") throw err;
+    return { ok: false, status: err instanceof Error ? err.message : "unreachable" };
+  }
+}
+
+/** The version the frontend bundle was built with, if the build set it. */
+export const FRONTEND_BUILD: string = str(import.meta.env.VITE_PS_BUILD) ?? "dev";