feat: Foundation — auth system, 9 migrations, React frontend

Backend:
- Express server with JWT httpOnly cookie auth
- POST /api/auth/register, /api/auth/login, /api/auth/logout, GET /api/auth/me
- bcrypt 12 rounds, generic 401 errors (no email/password field disclosure)
- Auth middleware protects all /api/* routes except register/login
- pg Pool database connection

Frontend (React + Vite + TailwindCSS + shadcn/ui):
- AuthContext with session restore on page load via /api/auth/me
- ProtectedRoute redirects unauthenticated users to /login
- LoginPage, RegisterPage — Hebrew RTL layout (dir=rtl), inline validation
- DashboardPage placeholder
- shadcn/ui components: Button, Input, Label, Card

Database:
- 9 migrations (001-009): extensions, users, events, vendors, guests,
  bookings, invitations, vendor_ratings, organizer_preferences
- pg_trgm for fuzzy Hebrew search, GIN indexes on style_tags
- Phase 2+3 fields included: source, payment_status, contract_value,
  vendor ratings 6-dimension, organizer preferences
- Idempotent migration runner with schema_migrations tracking table

Infrastructure:
- Dockerfile (multi-stage: build React → production node:20-alpine)
- docker-compose.yml with PostgreSQL healthcheck, expose not ports
- Migrations run automatically on container start

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/006_create_bookings.sql

@@ -0,0 +1,35 @@
+-- Migration 006: Create bookings table
+-- UP
+BEGIN;
+
+CREATE TYPE booking_status  AS ENUM ('pending', 'confirmed', 'cancelled');
+CREATE TYPE payment_status  AS ENUM ('unpaid', 'deposit_paid', 'fully_paid');  -- Phase 3: AI/financial
+
+CREATE TABLE bookings (
+  id              UUID           PRIMARY KEY DEFAULT gen_random_uuid(),
+  event_id        UUID           NOT NULL REFERENCES events(id) ON DELETE CASCADE,
+  vendor_id       UUID           NOT NULL REFERENCES vendors(id) ON DELETE CASCADE,
+  status          booking_status NOT NULL DEFAULT 'pending',
+  agreed_price    DECIMAL(12, 2),
+  notes           TEXT,
+  -- Phase 3: AI recommendation & financial tracking
+  contract_value  DECIMAL(12, 2),                -- actual signed contract value in NIS
+  payment_status  payment_status NOT NULL DEFAULT 'unpaid',
+  deleted_at      TIMESTAMPTZ,                   -- soft delete
+  created_at      TIMESTAMPTZ    NOT NULL DEFAULT NOW(),
+  updated_at      TIMESTAMPTZ    NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_bookings_event_id       ON bookings(event_id);
+CREATE INDEX idx_bookings_vendor_id      ON bookings(vendor_id);
+CREATE INDEX idx_bookings_status         ON bookings(status);
+CREATE INDEX idx_bookings_payment_status ON bookings(payment_status);
+
+COMMIT;
+
+-- DOWN
+-- BEGIN;
+-- DROP TABLE IF EXISTS bookings;
+-- DROP TYPE IF EXISTS payment_status;
+-- DROP TYPE IF EXISTS booking_status;
+-- COMMIT;