Milestones 0 and 1: foundation and money in (20261007.10)

Foundation: single arm64 container (Hono + SQLite via Drizzle, React + Vite),
local sign-in with long-lived sessions and passkeys, roles (read-only, full
access, admin), nightly and pre-upgrade backups, light and dark themes,
date-based version numbers, and the ideas lightbulb behind IDEAS_ENABLED.

Money in: accounts with balances, CSV import with bank detection, a column
mapping pop-up for unknown layouts, duplicate checks, transfer pairing and
undo; one-tap review with learned rules; activity with search, splits, tags,
notes and cash entries. Statement files are blocked from commits by a
pre-commit hook; tests use synthetic fixtures only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

compose.yaml

@@ -0,0 +1,34 @@
+# Spendlight. Start with scripts/deploy.sh, which builds a versioned image
+# first. Settings live in .env (copy .env.example to begin).
+name: spendlight
+
+services:
+  spendlight:
+    image: spendlight:latest
+    build:
+      context: .
+      args:
+        APP_VERSION: ${APP_VERSION:-dev}
+    container_name: spendlight
+    restart: unless-stopped
+    env_file:
+      - path: .env
+        required: false
+    environment:
+      TZ: ${TZ:-America/New_York}
+      # HTTPS is handled by a reverse proxy (NGINX) in front of the app.
+      TRUST_PROXY: "true"
+    ports:
+      - "${HOST_PORT:-8095}:3000"
+    volumes:
+      - ${DATA_PATH:-./data}:/data
+      - ${BACKUP_PATH:-./backups}:/backups
+    user: "${PUID:-1000}:${PGID:-1000}"
+    read_only: true
+    tmpfs:
+      - /tmp
+    mem_limit: 256m
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL