Add full application: receipt scanning, auth, billing, and account deletion

Brings the working codebase (Next.js app, auth system, Stripe billing,
Docker/deploy config, tests, docs) into version control on top of the
placeholder initial commit, and adds account self-deletion (Danger Zone
in Settings, password + typed-email confirmation, cascading DB cleanup,
Stripe cancellation) per GDPR right-to-erasure.

Excludes local build caches, node_modules, and internal agent scratch
files; .gitignore hardened to keep those out going forward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/adversarial-deep-scan.mjs

@@ -0,0 +1,36 @@
+import fs from 'fs';
+import path from 'path';
+
+function walk(dir) {
+  let results = [];
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results = results.concat(walk(fullPath));
+    } else if (/\.(tsx|ts|jsx|js|css|scss)$/.test(entry.name)) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+const files = walk('src');
+console.log(`Deep scanning ${files.length} source files in src/...`);
+
+const rawMatches = [];
+
+files.forEach(f => {
+  const content = fs.readFileSync(f, 'utf8');
+  const lines = content.split('\n');
+  lines.forEach((l, i) => {
+    if (/round|shadow|gradient/i.test(l)) {
+      rawMatches.push({ file: f, line: i + 1, content: l.trim() });
+    }
+  });
+});
+
+console.log(`Total occurrences found: ${rawMatches.length}`);
+rawMatches.forEach((m, idx) => {
+  console.log(`${idx + 1}. ${m.file}:${m.line} -> ${m.content}`);
+});