Add full application: receipt scanning, auth, billing, and account deletion

Brings the working codebase (Next.js app, auth system, Stripe billing,
Docker/deploy config, tests, docs) into version control on top of the
placeholder initial commit, and adds account self-deletion (Danger Zone
in Settings, password + typed-email confirmation, cascading DB cleanup,
Stripe cancellation) per GDPR right-to-erasure.

Excludes local build caches, node_modules, and internal agent scratch
files; .gitignore hardened to keep those out going forward.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/register-next-server-resolve.mjs

@@ -0,0 +1,21 @@
+/**
+ * Node.js resolve hook used ONLY by scripts/verify_sensitive_paths.mjs when run
+ * with plain `node` (no bundler, no tsx).
+ *
+ * Next ships `next/server.js` but no package.json "exports" map, so bundlers
+ * resolve `next/server` by extension-guessing while plain Node ESM does not.
+ * This hook remaps the bare specifier `next/server` -> `next/server.js` for the
+ * duration of the test process. Not used by the app itself.
+ *
+ * Run:  node --import ./scripts/register-next-server-resolve.mjs scripts/verify_sensitive_paths.mjs
+ */
+import { registerHooks } from "node:module";
+
+registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (specifier === "next/server") {
+      return nextResolve("next/server.js", context);
+    }
+    return nextResolve(specifier, context);
+  },
+});