Add full application: receipt scanning, auth, billing, and account deletion

Brings the working codebase (Next.js app, auth system, Stripe billing,
Docker/deploy config, tests, docs) into version control on top of the
placeholder initial commit, and adds account self-deletion (Danger Zone
in Settings, password + typed-email confirmation, cascading DB cleanup,
Stripe cancellation) per GDPR right-to-erasure.

Excludes local build caches, node_modules, and internal agent scratch
files; .gitignore hardened to keep those out going forward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/cors-resolve-hook.mjs

@@ -0,0 +1,15 @@
+/**
+ * Node.js ESM resolve hook used by the CORS verification harness.
+ *
+ * Next.js ships no package.json "exports" map, so the canonical bare specifier
+ * `next/server` does not resolve under raw Node ESM (the Next.js bundler
+ * resolves it itself). This hook maps it to the actual CJS file so the
+ * middleware module under test (src/lib/http/cors.ts, which imports
+ * `next/server`) can be loaded by plain `node` for verification.
+ */
+export async function resolve(specifier, context, nextResolve) {
+  if (specifier === "next/server") {
+    return nextResolve("next/server.js", context);
+  }
+  return nextResolve(specifier, context);
+}