Initial import: property management SaaS + security hardening + admin dashboard

Property Management Network — Next.js 16 (App Router), Better Auth,
Drizzle ORM over PostgreSQL, Stripe, OpenAI, Resend.

Includes:
- Security hardening: access-control/IDOR fixes, TLS-by-default DB layer,
  constant-time cron auth, strict security headers, atomic AI quota gating,
  HTML/email output encoding, demo-backdoor disabled in production.
- Superadmin dashboard at /admin (overview/MRR, server-paginated users with
  ban/impersonate/plan/delete, billing, platform activity + admin audit log,
  AI usage, system health) via the Better Auth admin plugin.
- Seed/migration utility scripts under scripts/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-entrypoint.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+# Apply pending database migrations before the server accepts traffic.
+# Disable for multi-replica deploys (run migrations as a separate one-off job)
+# by setting RUN_MIGRATIONS_ON_START=false.
+if [ "${RUN_MIGRATIONS_ON_START:-true}" = "true" ]; then
+  echo "[entrypoint] Running database migrations..."
+  node scripts/migrate.mjs
+else
+  echo "[entrypoint] RUN_MIGRATIONS_ON_START=false — skipping migrations."
+fi
+
+echo "[entrypoint] Starting Next.js on ${HOSTNAME:-0.0.0.0}:${PORT:-3000}"
+exec node server.js