feat: Foundation — auth system, 9 migrations, React frontend

Backend:
- Express server with JWT httpOnly cookie auth
- POST /api/auth/register, /api/auth/login, /api/auth/logout, GET /api/auth/me
- bcrypt 12 rounds, generic 401 errors (no email/password field disclosure)
- Auth middleware protects all /api/* routes except register/login
- pg Pool database connection

Frontend (React + Vite + TailwindCSS + shadcn/ui):
- AuthContext with session restore on page load via /api/auth/me
- ProtectedRoute redirects unauthenticated users to /login
- LoginPage, RegisterPage — Hebrew RTL layout (dir=rtl), inline validation
- DashboardPage placeholder
- shadcn/ui components: Button, Input, Label, Card

Database:
- 9 migrations (001-009): extensions, users, events, vendors, guests,
  bookings, invitations, vendor_ratings, organizer_preferences
- pg_trgm for fuzzy Hebrew search, GIN indexes on style_tags
- Phase 2+3 fields included: source, payment_status, contract_value,
  vendor ratings 6-dimension, organizer preferences
- Idempotent migration runner with schema_migrations tracking table

Infrastructure:
- Dockerfile (multi-stage: build React → production node:20-alpine)
- docker-compose.yml with PostgreSQL healthcheck, expose not ports
- Migrations run automatically on container start

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/005_create_guests.sql

@@ -0,0 +1,56 @@
+-- Migration 005: Create guests table
+-- UP
+BEGIN;
+
+CREATE TYPE rsvp_status        AS ENUM ('pending', 'confirmed', 'declined');
+CREATE TYPE relationship_group AS ENUM ('family_bride', 'family_groom', 'friends', 'work', 'community', 'other');
+CREATE TYPE dietary_preference AS ENUM ('none', 'vegetarian', 'vegan', 'kosher_regular', 'kosher_mehadrin');
+CREATE TYPE guest_source       AS ENUM ('registered', 'walkin');  -- Phase 2: analytics
+
+CREATE TABLE guests (
+  id                   UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
+  event_id             UUID         NOT NULL REFERENCES events(id) ON DELETE CASCADE,
+  -- Name (Hebrew required; Latin transliteration for non-Hebrew speakers)
+  name_hebrew          VARCHAR(255) NOT NULL,
+  name_transliteration VARCHAR(255),
+  -- Contact (Israeli E.164 phone format: +972XXXXXXXXX)
+  email                VARCHAR(255),
+  phone                VARCHAR(20),
+  -- RSVP
+  rsvp_status          rsvp_status  NOT NULL DEFAULT 'pending',
+  -- Seating
+  table_number         INTEGER,
+  seat_number          VARCHAR(10),
+  -- Social grouping
+  relationship_group   relationship_group,
+  plus_one_of          UUID         REFERENCES guests(id) ON DELETE SET NULL,  -- self-ref FK
+  plus_one_allowance   INTEGER      NOT NULL DEFAULT 0,
+  -- Preferences
+  dietary_preference   dietary_preference NOT NULL DEFAULT 'none',
+  dietary_notes        TEXT,                     -- free-text override/additions
+  accessibility_needs  TEXT,
+  -- Phase 2: Day-of check-in
+  source               guest_source NOT NULL DEFAULT 'registered',  -- analytics (walk-ins vs pre-registered)
+  -- Israeli Privacy Law 2023 compliance
+  privacy_accepted_at  TIMESTAMPTZ,
+  -- NO deleted_at: guests support hard delete only (data subject right per Israeli Privacy Law)
+  created_at           TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+  updated_at           TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_guests_event_id      ON guests(event_id);
+CREATE INDEX idx_guests_rsvp_status   ON guests(rsvp_status);
+CREATE INDEX idx_guests_plus_one_of   ON guests(plus_one_of);
+-- pg_trgm GIN index for Phase 2 fuzzy Hebrew name search (requires pg_trgm from migration 001)
+CREATE INDEX idx_guests_name_trgm     ON guests USING GIN(name_hebrew gin_trgm_ops);
+
+COMMIT;
+
+-- DOWN
+-- BEGIN;
+-- DROP TABLE IF EXISTS guests;
+-- DROP TYPE IF EXISTS guest_source;
+-- DROP TYPE IF EXISTS dietary_preference;
+-- DROP TYPE IF EXISTS relationship_group;
+-- DROP TYPE IF EXISTS rsvp_status;
+-- COMMIT;