Add full application: receipt scanning, auth, billing, and account deletion

Brings the working codebase (Next.js app, auth system, Stripe billing,
Docker/deploy config, tests, docs) into version control on top of the
placeholder initial commit, and adds account self-deletion (Danger Zone
in Settings, password + typed-email confirmation, cascading DB cleanup,
Stripe cancellation) per GDPR right-to-erasure.

Excludes local build caches, node_modules, and internal agent scratch
files; .gitignore hardened to keep those out going forward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,125 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: scanreceipts_postgres
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-receipt_user}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-receipt_secure_password}
+      POSTGRES_DB: ${POSTGRES_DB:-receipt_scanner}
+    ports:
+      # Host port 5436 by default: 5432 is commonly taken by another project's
+      # database on a dev machine, and binding it would fail the whole stack.
+      # The container still listens on 5432 internally, so the `app` service's
+      # DATABASE_URL (postgres:5432) is unaffected.
+      - "${POSTGRES_PORT:-5436}:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      # Database least privilege: provision the runtime role `receipt_app` on a
+      # FRESH volume. Initdb scripts run as POSTGRES_USER (superuser), which is
+      # exactly the rights needed to create the role and set default privileges.
+      # They only run once, at first volume creation — an already-initialized
+      # database (like the local dev DB) must be set up with
+      # `node scripts/apply-db-permissions.mjs` instead.
+      - ./scripts/db-permissions.sql:/docker-entrypoint-initdb.d/10-db-permissions.sql:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-receipt_user} -d ${POSTGRES_DB:-receipt_scanner}"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    networks:
+      - scanreceipts_network
+
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
+        NEXT_PUBLIC_UMAMI_SRC: ${NEXT_PUBLIC_UMAMI_SRC:-}
+        NEXT_PUBLIC_UMAMI_ID: ${NEXT_PUBLIC_UMAMI_ID:-}
+    container_name: scanreceipts_app
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    ports:
+      - "3000:3000"
+    volumes:
+      # Grants the admin dashboard's "Docker Logs" page (/admin/logs) access
+      # to `docker logs -f`. SECURITY: mounting the Docker socket gives this
+      # container root-equivalent control of the host — anyone who can
+      # execute code inside the app container (e.g. via an app vulnerability)
+      # can use it to control every container and, from there, the host
+      # itself. The API route is admin-gated (getAdminUser), but that only
+      # protects the intended entry point, not this blast radius. Remove this
+      # mount (and docker-entrypoint-logs.sh / the docker-cli + su-exec
+      # packages in the Dockerfile) if that trade-off isn't acceptable for
+      # your deployment.
+      # Not :ro — docker-entrypoint-logs.sh chmods the socket at container
+      # startup (see that script for why a plain group-permission fix isn't
+      # reliable here), which needs the mount to be writable.
+      - /var/run/docker.sock:/var/run/docker.sock
+    healthcheck:
+      # 127.0.0.1, not localhost: Alpine's musl resolver returns ::1 first for
+      # "localhost", but the Next.js standalone server (HOSTNAME=0.0.0.0 in the
+      # Dockerfile) only binds IPv4 — wget to "localhost" gets connection
+      # refused on ::1 even while the app is completely healthy on IPv4.
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:3000/api/auth/providers"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    environment:
+      - NODE_ENV=production
+      # Container-internal address: the host port mapping above is irrelevant in
+      # here, services reach each other by service name on the compose network.
+      - DATABASE_URL=postgresql://${POSTGRES_USER:-receipt_user}:${POSTGRES_PASSWORD:-receipt_secure_password}@postgres:5432/${POSTGRES_DB:-receipt_scanner}
+      # Least-privilege runtime connection (optional): points at the restricted
+      # `receipt_app` role created by scripts/db-permissions.sql. The app
+      # binary reads DATABASE_URL above, so in production run the runtime with
+      # this URL and keep DATABASE_URL (the owner) for migrations/schema init.
+      - APP_DATABASE_URL=postgresql://receipt_app:${APP_DATABASE_PASSWORD:-receipt_app_secure_password}@postgres:5432/${POSTGRES_DB:-receipt_scanner}
+      - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
+      - NEXT_PUBLIC_UMAMI_SRC=${NEXT_PUBLIC_UMAMI_SRC:-}
+      - NEXT_PUBLIC_UMAMI_ID=${NEXT_PUBLIC_UMAMI_ID:-}
+      - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}
+      - OPENROUTER_MODEL=${OPENROUTER_MODEL:-openai/gpt-5.6-luna}
+      # Vision fallbacks — scanning still works on OpenRouter alone, but without
+      # these the fallback chain has nowhere to go.
+      - GEMINI_API_KEY=${GEMINI_API_KEY}
+      - OPENAI_API_KEY=${OPENAI_API_KEY}
+      - DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY}
+      - DEEPSEEK_BASE_URL=${DEEPSEEK_BASE_URL}
+      - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}
+      - STRIPE_PUBLISHABLE_KEY=${STRIPE_PUBLISHABLE_KEY}
+      - STRIPE_WEBHOOK_SECRET=${STRIPE_WEBHOOK_SECRET}
+      - STRIPE_WEEKLY_PRICE_ID=${STRIPE_WEEKLY_PRICE_ID}
+      - STRIPE_ANNUAL_PRICE_ID=${STRIPE_ANNUAL_PRICE_ID}
+      - STRIPE_LIFETIME_PRICE_ID=${STRIPE_LIFETIME_PRICE_ID}
+      - DISCORD_SALES_WEBHOOK_URL=${DISCORD_SALES_WEBHOOK_URL}
+      # Auth: without these the Google button never renders and signup fails
+      # with mail_failed, because NODE_ENV=production refuses the dev fallback.
+      - GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
+      - GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
+      - SMTP_HOST=${SMTP_HOST}
+      - SMTP_PORT=${SMTP_PORT:-587}
+      - SMTP_USER=${SMTP_USER}
+      - SMTP_PASSWORD=${SMTP_PASSWORD}
+      - SMTP_SECURE=${SMTP_SECURE:-false}
+      - MAIL_FROM=${MAIL_FROM:-ScanReceipts <no-reply@localhost>}
+      - ADMIN_EMAILS=${ADMIN_EMAILS:-}
+      # CORS allowlist: comma-separated extra origins allowed to call the API.
+      # The app's own origin (NEXT_PUBLIC_APP_URL) is always allowed.
+      - CORS_ORIGINS=${CORS_ORIGINS:-}
+    networks:
+      - scanreceipts_network
+
+volumes:
+  postgres_data:
+    driver: local
+
+networks:
+  scanreceipts_network:
+    driver: bridge