Harden template for production: add comments, fix bugs, add lock file

- Add inline comments to docker-compose.yml explaining the 5 key rules
  (expose vs ports, DB host, DB name persistence, no Traefik labels)
- Add comments to Dockerfile explaining multi-stage build, layer caching,
  and why .dockerignore excludes client/dist
- Add comments to .dockerignore explaining each exclusion
- Fix dev script: use nodemon (auto-restart) instead of node for server.js
- Add postinstall script to auto-install client deps (cd client && npm install)
- Fix SPA fallback: bare return → next() to prevent hanging requests
- Add root package-lock.json for deterministic server dependency installs
- Remove committed tsconfig.tsbuildinfo build artifact, add *.tsbuildinfo to .gitignore
- Update README: simpler install (npm install handles everything), reference SAAC_DEPLOYMENT.md,
  use npx instead of pnpm dlx for shadcn components

server.js

@@ -73,9 +73,9 @@ app.get('/api/status', async (req, res) => {
 const clientDist = path.join(__dirname, 'client', 'dist');
 app.use(express.static(clientDist));
 
-// SPA fallback — all non-API routes serve index.html
-app.get('*', (req, res) => {
-  if (req.path.startsWith('/api/') || req.path === '/health') return;
+// SPA fallback — all non-API routes serve index.html so React Router works
+app.get('*', (req, res, next) => {
+  if (req.path.startsWith('/api/') || req.path === '/health') return next();
   res.sendFile(path.join(clientDist, 'index.html'));
 });