feat: Foundation — auth system, 9 migrations, React frontend

Backend:
- Express server with JWT httpOnly cookie auth
- POST /api/auth/register, /api/auth/login, /api/auth/logout, GET /api/auth/me
- bcrypt 12 rounds, generic 401 errors (no email/password field disclosure)
- Auth middleware protects all /api/* routes except register/login
- pg Pool database connection

Frontend (React + Vite + TailwindCSS + shadcn/ui):
- AuthContext with session restore on page load via /api/auth/me
- ProtectedRoute redirects unauthenticated users to /login
- LoginPage, RegisterPage — Hebrew RTL layout (dir=rtl), inline validation
- DashboardPage placeholder
- shadcn/ui components: Button, Input, Label, Card

Database:
- 9 migrations (001-009): extensions, users, events, vendors, guests,
  bookings, invitations, vendor_ratings, organizer_preferences
- pg_trgm for fuzzy Hebrew search, GIN indexes on style_tags
- Phase 2+3 fields included: source, payment_status, contract_value,
  vendor ratings 6-dimension, organizer preferences
- Idempotent migration runner with schema_migrations tracking table

Infrastructure:
- Dockerfile (multi-stage: build React → production node:20-alpine)
- docker-compose.yml with PostgreSQL healthcheck, expose not ports
- Migrations run automatically on container start

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

migrations/008_create_vendor_ratings.sql

@@ -0,0 +1,35 @@
+-- Migration 008: Create vendor_ratings table (Phase 3: AI recommendation engine)
+-- UP
+BEGIN;
+
+CREATE TABLE vendor_ratings (
+  id                    UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+  event_id              UUID        NOT NULL REFERENCES events(id) ON DELETE CASCADE,
+  vendor_id             UUID        NOT NULL REFERENCES vendors(id) ON DELETE CASCADE,
+  organizer_id          UUID        NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  -- 6-dimension rating system (1-5 scale)
+  quality_score         SMALLINT    NOT NULL CHECK (quality_score BETWEEN 1 AND 5),
+  professionalism_score SMALLINT    NOT NULL CHECK (professionalism_score BETWEEN 1 AND 5),
+  flexibility_score     SMALLINT    NOT NULL CHECK (flexibility_score BETWEEN 1 AND 5),
+  value_score           SMALLINT    NOT NULL CHECK (value_score BETWEEN 1 AND 5),
+  -- Boolean recommendation signals
+  would_use_again       BOOLEAN     NOT NULL,
+  would_recommend       BOOLEAN     NOT NULL,
+  -- Optional review text
+  review_text           TEXT,
+  rated_at              TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  created_at            TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  -- One rating per (event, vendor, organizer) tuple
+  CONSTRAINT uq_vendor_rating UNIQUE (event_id, vendor_id, organizer_id)
+);
+
+CREATE INDEX idx_vendor_ratings_vendor_id    ON vendor_ratings(vendor_id);
+CREATE INDEX idx_vendor_ratings_organizer_id ON vendor_ratings(organizer_id);
+CREATE INDEX idx_vendor_ratings_event_id     ON vendor_ratings(event_id);
+
+COMMIT;
+
+-- DOWN
+-- BEGIN;
+-- DROP TABLE IF EXISTS vendor_ratings;
+-- COMMIT;