WP-00: application foundation

Scaffolds the project: Next.js 16 App Router with strict TypeScript,
Prisma 7 on PostgreSQL 16, Tailwind 4, Vitest, Playwright, CI, and a
standalone Docker image that applies migrations on boot.

Makes the no-tracker rule of PLAN.md 3.7 enforceable rather than
stated. A per-request nonce-based CSP names no external origin, a unit
test fails if any network directive gains one, and a second test fails
if a tracking package appears in package.json. The end-to-end test
drives the standalone server the Docker image runs, not `next dev`,
so a proxy matcher that stopped matching could not pass unnoticed.

Environment is validated at import, so a missing DATABASE_URL fails at
boot with a readable message instead of surfacing later as a driver
error mid-export. ENCRYPTION_KEY is checked to be 32 bytes.

Three deviations from the plan, recorded in PLAN.md and README:
Next 16 rather than 15, `proxy.ts` rather than the now-deprecated
`middleware.ts`, and database-backed sessions rather than Auth.js v5,
which is still beta and whose JWTs would make the session revocation
required by compliance item 23 awkward.

Verified locally against PostgreSQL 16: migrations apply, extensions
created, typecheck, lint, 9 unit tests and the end-to-end header test
all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv

src/lib/env.ts

@@ -0,0 +1,45 @@
+import { z } from 'zod';
+
+/**
+ * Environment contract, validated once at import.
+ *
+ * A missing DATABASE_URL should fail at boot with a readable message, not
+ * surface later as an opaque driver error in the middle of a payroll export.
+ */
+const schema = z.object({
+  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
+
+  DATABASE_URL: z.url({ protocol: /^postgres(ql)?$/ }),
+
+  /**
+   * Application-level encryption key for the columns PLAN.md §3.6 requires at
+   * rest (NIR, IBAN, BIC). 32 bytes, base64. Kept out of the database so a dump
+   * alone does not disclose them.
+   */
+  ENCRYPTION_KEY: z
+    .string()
+    .refine(
+      (value) => Buffer.from(value, 'base64').length === 32,
+      'ENCRYPTION_KEY doit être 32 octets encodés en base64',
+    ),
+
+  /** Public origin, used for links in invitation and notification e-mails. */
+  APP_URL: z.url().default('http://localhost:3000'),
+});
+
+export type Env = z.infer<typeof schema>;
+
+function load(): Env {
+  const parsed = schema.safeParse(process.env);
+
+  if (!parsed.success) {
+    const details = parsed.error.issues
+      .map((issue) => `  - ${issue.path.join('.')}: ${issue.message}`)
+      .join('\n');
+    throw new Error(`Configuration d'environnement invalide :\n${details}`);
+  }
+
+  return parsed.data;
+}
+
+export const env = load();