Milestones 0 and 1: foundation and money in (20261007.10)

Foundation: single arm64 container (Hono + SQLite via Drizzle, React + Vite),
local sign-in with long-lived sessions and passkeys, roles (read-only, full
access, admin), nightly and pre-upgrade backups, light and dark themes,
date-based version numbers, and the ideas lightbulb behind IDEAS_ENABLED.

Money in: accounts with balances, CSV import with bank detection, a column
mapping pop-up for unknown layouts, duplicate checks, transfer pairing and
undo; one-tap review with learned rules; activity with search, splits, tags,
notes and cash entries. Statement files are blocked from commits by a
pre-commit hook; tests use synthetic fixtures only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.githooks/pre-commit

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Spendlight safety check: refuse any commit that would include real
+# statements, databases or backups. Only made-up test files under a
+# fixtures/synthetic/ folder may be CSV, OFX, QFX, QBO or Excel.
+staged=$(git diff --cached --name-only --diff-filter=ACMR)
+blocked=$(printf '%s\n' "$staged" \
+  | grep -E -i '^(samples|data|backups)/|\.(csv|ofx|qfx|qbo|xls|xlsx|sqlite|sqlite3|db)$' \
+  | grep -v -E '^samples/README\.md$|(^|/)fixtures/synthetic/' || true)
+if [ -n "$blocked" ]; then
+  echo "Commit blocked: these files look like real financial data." >&2
+  printf '  %s\n' $blocked >&2
+  echo "Statement files stay on the server. Test files belong in fixtures/synthetic/." >&2
+  exit 1
+fi