Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell

New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.

- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
  SECURITY rewritten for the server with the requirement ID table, DEPLOY,
  stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
  healthcheck. Settings from the environment with secret files. Stack guard
  (test never points at VISUAL production). Security headers and CSP.
  Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
  hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
  index only), compose base, proxy overlay for npm_default, CI overlay,
  postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
  self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
  database checks pass, 77 server tests pass against PostgreSQL.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

tests/server/test_guard.py

@@ -0,0 +1,60 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from pshelpers import fake_visual, make_settings
+from visualkit.config import Settings as VisualSettings
+
+from packetstation import guard
+from packetstation.main import create_app
+
+
+@pytest.mark.parametrize("stack", ["test", "ci", "dev"])
+def test_non_prod_stack_refuses_production_target(tmp_path: Path, stack: str) -> None:
+    s = make_settings(tmp_path, stack=stack)
+    with pytest.raises(guard.StackGuardError, match="production"):
+        guard.check_stack(s, fake_visual(production=True, explicit=True))
+
+
+def test_non_prod_stack_with_dev_target_ok(tmp_path: Path) -> None:
+    r = guard.check_stack(make_settings(tmp_path, stack="test"), fake_visual(False))
+    assert not r.production and r.warnings == []
+
+
+def test_prod_stack_refuses_implicit_dev(tmp_path: Path) -> None:
+    with pytest.raises(guard.StackGuardError, match="default to DEV"):
+        guard.check_stack(make_settings(tmp_path, stack="prod"), fake_visual(False, explicit=False))
+
+
+def test_prod_stack_explicit_dev_warns(tmp_path: Path) -> None:
+    r = guard.check_stack(make_settings(tmp_path, stack="prod"), fake_visual(False, explicit=True))
+    assert r.warnings and "non-production" in r.warnings[0]
+
+
+def test_prod_stack_production_ok(tmp_path: Path) -> None:
+    r = guard.check_stack(make_settings(tmp_path, stack="prod"), fake_visual(True, explicit=True))
+    assert r.production and r.warnings == []
+
+
+def test_with_real_visualkit_settings(tmp_path: Path) -> None:
+    # No connection is made: only VisualKit's settings object is built.
+    prod = VisualSettings(_env_file=None, profile="prod")
+    dev_default = VisualSettings(_env_file=None)
+    assert prod.is_production and not dev_default.is_production
+    with pytest.raises(guard.StackGuardError):
+        guard.check_stack(make_settings(tmp_path, stack="ci"), prod)
+    with pytest.raises(guard.StackGuardError):
+        guard.check_stack(make_settings(tmp_path, stack="prod"), dev_default)
+    assert guard.check_stack(make_settings(tmp_path, stack="prod"), prod).production
+
+
+def test_ldap_insecure_warns_off_prod(tmp_path: Path) -> None:
+    r = guard.check_stack(make_settings(tmp_path, stack="test", ldap_allow_insecure=True), fake_visual(False))
+    assert any("LDAP_ALLOW_INSECURE" in w for w in r.warnings)
+
+
+def test_app_refuses_to_start(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(guard, "load_visual_settings", lambda: fake_visual(True, explicit=True))
+    with pytest.raises(guard.StackGuardError):
+        create_app(make_settings(tmp_path, stack="ci"))