T1/Phase 1: scaffold Vite SPA + Hono API + Bun worker

- apps/web: Vite + React 19 + TanStack Router/Query + shadcn/ui
   - apps/api: Hono + Bun on :3001 with /api/health, /api/auth/*, /mcp stubs
   - apps/worker: Bun worker stub, DB connection, graceful SIGTERM
   - apps/web-legacy/: old Next.js code moved aside (preserved for T2-T8 reference)
   - Dockerfiles: api (Bun), worker (Bun), spa (multi-stage Caddy)
   - Caddyfile: serves dist + reverse-proxies /api/* + /mcp to api
   - docker-compose.yml: 4-service target (api, spa, db, worker)
   - packages/db/src/client.ts: shared Drizzle client for api + worker
   - db/client.ts: root-level alias for convenience

   Parent: t_e1cbd87d -> t_24c9c3fd (T0)

apps/web-legacy/app/api/agent-activity/[id]/undo/route.ts

@@ -0,0 +1,46 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { getAuthUser, createErrorResponse } from '@/lib/auth';
+import { createPocketBaseClient } from '@/lib/pocketbase';
+
+type RouteContext = { params: Promise<{ id: string }> };
+
+// POST /api/agent-activity/[id]/undo — Undo an agent action
+export async function POST(request: NextRequest, context: RouteContext) {
+  const user = await getAuthUser(request);
+  if (!user) {
+    return NextResponse.json(
+      { error: { code: 'UNAUTHORIZED', message: 'Authentication required' } },
+      { status: 401 }
+    );
+  }
+
+  const { id } = await context.params;
+
+  try {
+    const pb = createPocketBaseClient();
+
+    // Get the activity record
+    const activity = await pb.collection('agent_activity').getOne(id);
+
+    if (!activity.before_state) {
+      return createErrorResponse('CANNOT_UNDO', 'This action cannot be undone', 400);
+    }
+
+    // Restore the previous state
+    const entityType = activity.entity_type;
+    const entityId = activity.entity_id;
+    const beforeState = activity.before_state;
+
+    await pb.collection(entityType).update(entityId, beforeState);
+
+    return NextResponse.json({ success: true, message: 'Action undone' });
+  } catch (error) {
+    console.error('Failed to undo activity:', error);
+    return createErrorResponse('UNDO_FAILED', 'Failed to undo action', 500);
+  }
+}