Initial commit: HOA Financial Intelligence Platform MVP

Multi-tenant financial management platform for homeowner associations featuring:
- NestJS backend with 16 modules (auth, accounts, transactions, budgets, units,
  invoices, payments, vendors, reserves, investments, capital projects, reports)
- React + Mantine frontend with dashboard, CRUD pages, and financial reports
- Schema-per-tenant PostgreSQL isolation with JWT-based tenant resolution
- Docker Compose infrastructure (nginx, backend, frontend, postgres, redis)
- Comprehensive seed data for Sunrise Valley HOA demo
- 39 API endpoints with Swagger documentation
- Double-entry bookkeeping with journal entries
- Budget vs actual reporting and Sankey cash flow visualization

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/src/database/tenant.middleware.ts

@@ -0,0 +1,37 @@
+import { Injectable, NestMiddleware } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { Request, Response, NextFunction } from 'express';
+import * as jwt from 'jsonwebtoken';
+
+export interface TenantRequest extends Request {
+  tenantSchema?: string;
+  orgId?: string;
+  userId?: string;
+  userRole?: string;
+}
+
+@Injectable()
+export class TenantMiddleware implements NestMiddleware {
+  constructor(private configService: ConfigService) {}
+
+  use(req: TenantRequest, _res: Response, next: NextFunction) {
+    // Try to extract tenant info from Authorization header JWT
+    const authHeader = req.headers.authorization;
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+      try {
+        const token = authHeader.substring(7);
+        const secret = this.configService.get<string>('JWT_SECRET');
+        const decoded = jwt.verify(token, secret!) as any;
+        if (decoded?.orgSchema) {
+          req.tenantSchema = decoded.orgSchema;
+          req.orgId = decoded.orgId;
+          req.userId = decoded.sub;
+          req.userRole = decoded.role;
+        }
+      } catch {
+        // Token invalid or expired - let Passport handle the auth error
+      }
+    }
+    next();
+  }
+}