T1/Phase 1: scaffold Vite SPA + Hono API + Bun worker

- apps/web: Vite + React 19 + TanStack Router/Query + shadcn/ui
   - apps/api: Hono + Bun on :3001 with /api/health, /api/auth/*, /mcp stubs
   - apps/worker: Bun worker stub, DB connection, graceful SIGTERM
   - apps/web-legacy/: old Next.js code moved aside (preserved for T2-T8 reference)
   - Dockerfiles: api (Bun), worker (Bun), spa (multi-stage Caddy)
   - Caddyfile: serves dist + reverse-proxies /api/* + /mcp to api
   - docker-compose.yml: 4-service target (api, spa, db, worker)
   - packages/db/src/client.ts: shared Drizzle client for api + worker
   - db/client.ts: root-level alias for convenience

   Parent: t_e1cbd87d -> t_24c9c3fd (T0)

apps/web-legacy/app/api/domains/[domainId]/dashboard/widgets/recent-notes/route.ts

@@ -0,0 +1,34 @@
+// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
+// 1. Insert activity feed entry
+// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
+// See AGENTS.md for full rules.
+
+import { NextRequest, NextResponse } from 'next/server';
+import { withAuth, requireWorkspaceAccess } from '@/lib/auth';
+import { db, notes } from '@project-e/db';
+import { and, desc, eq, isNull } from 'drizzle-orm';
+
+type RouteContext = { params: Promise<{ domainId: string }> };
+
+// GET /api/domains/[domainId]/dashboard/widgets/recent-notes
+export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
+  const { domainId } = await context!.params;
+  await requireWorkspaceAccess(domainId);
+
+  const items = await db.select({
+    id: notes.id,
+    title: notes.title,
+    updatedAt: notes.updatedAt,
+    isPinned: notes.isPinned,
+  })
+    .from(notes)
+    .where(and(
+      eq(notes.domainId, domainId),
+      eq(notes.isArchived, false),
+      isNull(notes.deletedAt),
+    ))
+    .orderBy(desc(notes.updatedAt))
+    .limit(5);
+
+  return NextResponse.json({ items });
+});