WP-00: application foundation

Scaffolds the project: Next.js 16 App Router with strict TypeScript,
Prisma 7 on PostgreSQL 16, Tailwind 4, Vitest, Playwright, CI, and a
standalone Docker image that applies migrations on boot.

Makes the no-tracker rule of PLAN.md 3.7 enforceable rather than
stated. A per-request nonce-based CSP names no external origin, a unit
test fails if any network directive gains one, and a second test fails
if a tracking package appears in package.json. The end-to-end test
drives the standalone server the Docker image runs, not `next dev`,
so a proxy matcher that stopped matching could not pass unnoticed.

Environment is validated at import, so a missing DATABASE_URL fails at
boot with a readable message instead of surfacing later as a driver
error mid-export. ENCRYPTION_KEY is checked to be 32 bytes.

Three deviations from the plan, recorded in PLAN.md and README:
Next 16 rather than 15, `proxy.ts` rather than the now-deprecated
`middleware.ts`, and database-backed sessions rather than Auth.js v5,
which is still beta and whose JWTs would make the session revocation
required by compliance item 23 awkward.

Verified locally against PostgreSQL 16: migrations apply, extensions
created, typecheck, lint, 9 unit tests and the end-to-end header test
all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv

src/app/globals.css

@@ -0,0 +1 @@
+@import 'tailwindcss';

src/app/layout.tsx

@@ -0,0 +1,20 @@
+import type { Metadata } from 'next';
+
+import './globals.css';
+
+export const metadata: Metadata = {
+  title: 'PlanFlow',
+  description: 'Gestion du personnel, des plannings et des temps.',
+};
+
+export default function RootLayout({
+  children,
+}: Readonly<{ children: React.ReactNode }>) {
+  return (
+    <html lang="fr">
+      <body className="min-h-dvh bg-neutral-50 text-neutral-900 antialiased">
+        {children}
+      </body>
+    </html>
+  );
+}

src/app/page.tsx

@@ -0,0 +1,33 @@
+import { checkDatabase } from '@/server/health';
+
+export const dynamic = 'force-dynamic';
+
+export default async function HomePage() {
+  const database = await checkDatabase();
+
+  return (
+    <main className="mx-auto flex min-h-dvh max-w-2xl flex-col justify-center gap-6 p-8">
+      <div>
+        <h1 className="text-3xl font-semibold tracking-tight">PlanFlow</h1>
+        <p className="mt-2 text-neutral-600">
+          Socle applicatif — lot WP-00. Les écrans métier arrivent aux lots suivants.
+        </p>
+      </div>
+
+      <dl className="grid gap-3 rounded-lg border border-neutral-200 bg-white p-6">
+        <div className="flex items-center justify-between gap-4">
+          <dt className="text-sm text-neutral-600">Base de données</dt>
+          <dd
+            className={
+              database.ok
+                ? 'text-sm font-medium text-emerald-700'
+                : 'text-sm font-medium text-red-700'
+            }
+          >
+            {database.ok ? 'connectée' : `indisponible — ${database.error}`}
+          </dd>
+        </div>
+      </dl>
+    </main>
+  );
+}