T1/Phase 1: scaffold Vite SPA + Hono API + Bun worker

- apps/web: Vite + React 19 + TanStack Router/Query + shadcn/ui
   - apps/api: Hono + Bun on :3001 with /api/health, /api/auth/*, /mcp stubs
   - apps/worker: Bun worker stub, DB connection, graceful SIGTERM
   - apps/web-legacy/: old Next.js code moved aside (preserved for T2-T8 reference)
   - Dockerfiles: api (Bun), worker (Bun), spa (multi-stage Caddy)
   - Caddyfile: serves dist + reverse-proxies /api/* + /mcp to api
   - docker-compose.yml: 4-service target (api, spa, db, worker)
   - packages/db/src/client.ts: shared Drizzle client for api + worker
   - db/client.ts: root-level alias for convenience

   Parent: t_e1cbd87d -> t_24c9c3fd (T0)

apps/api/src/routes/auth.ts

@@ -0,0 +1,22 @@
+import { Hono } from "hono";
+
+export const authRoutes = new Hono();
+
+// POST /api/auth/credentials — stub JWT placeholder
+authRoutes.post("/credentials", async (c) => {
+  const { email, password } = await c.req.json();
+  // Stub: accept any credentials for now
+  if (!email || !password) {
+    return c.json({ message: "Email and password required" }, 400);
+  }
+  // Return a stub JWT (real auth in T2)
+  return c.json({
+    token: "stub-jwt-token",
+    user: { email, name: email.split("@")[0] },
+  });
+});
+
+// GET /api/auth/session — placeholder
+authRoutes.get("/session", (c) => {
+  return c.json({ authenticated: false, user: null });
+});