feat: Foundation — auth system, 9 migrations, React frontend

Backend:
- Express server with JWT httpOnly cookie auth
- POST /api/auth/register, /api/auth/login, /api/auth/logout, GET /api/auth/me
- bcrypt 12 rounds, generic 401 errors (no email/password field disclosure)
- Auth middleware protects all /api/* routes except register/login
- pg Pool database connection

Frontend (React + Vite + TailwindCSS + shadcn/ui):
- AuthContext with session restore on page load via /api/auth/me
- ProtectedRoute redirects unauthenticated users to /login
- LoginPage, RegisterPage — Hebrew RTL layout (dir=rtl), inline validation
- DashboardPage placeholder
- shadcn/ui components: Button, Input, Label, Card

Database:
- 9 migrations (001-009): extensions, users, events, vendors, guests,
  bookings, invitations, vendor_ratings, organizer_preferences
- pg_trgm for fuzzy Hebrew search, GIN indexes on style_tags
- Phase 2+3 fields included: source, payment_status, contract_value,
  vendor ratings 6-dimension, organizer preferences
- Idempotent migration runner with schema_migrations tracking table

Infrastructure:
- Dockerfile (multi-stage: build React → production node:20-alpine)
- docker-compose.yml with PostgreSQL healthcheck, expose not ports
- Migrations run automatically on container start

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/007_create_invitations.sql

@@ -0,0 +1,31 @@
+-- Migration 007: Create invitations table
+-- UP
+BEGIN;
+
+CREATE TYPE invitation_channel AS ENUM ('sms', 'whatsapp', 'email');
+
+CREATE TABLE invitations (
+  id          UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
+  event_id    UUID         NOT NULL REFERENCES events(id) ON DELETE CASCADE,
+  guest_id    UUID         NOT NULL REFERENCES guests(id) ON DELETE CASCADE,
+  token       VARCHAR(128) UNIQUE NOT NULL DEFAULT encode(gen_random_bytes(64), 'hex'),
+  channel     invitation_channel NOT NULL DEFAULT 'whatsapp',
+  -- MVP: wa.me deep-link (no Twilio/API required)
+  -- Format: https://wa.me/+972XXXXXXXXX?text=ENCODED_MESSAGE
+  whatsapp_link TEXT,                -- pre-generated deep-link for organizer to click
+  sent_at     TIMESTAMPTZ,           -- when organizer clicked Send
+  opened_at   TIMESTAMPTZ,           -- when guest opened the RSVP link
+  created_at  TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_invitations_event_id ON invitations(event_id);
+CREATE INDEX idx_invitations_guest_id ON invitations(guest_id);
+CREATE INDEX idx_invitations_token    ON invitations(token);
+
+COMMIT;
+
+-- DOWN
+-- BEGIN;
+-- DROP TABLE IF EXISTS invitations;
+-- DROP TYPE IF EXISTS invitation_channel;
+-- COMMIT;