WP-00: application foundation

Scaffolds the project: Next.js 16 App Router with strict TypeScript,
Prisma 7 on PostgreSQL 16, Tailwind 4, Vitest, Playwright, CI, and a
standalone Docker image that applies migrations on boot.

Makes the no-tracker rule of PLAN.md 3.7 enforceable rather than
stated. A per-request nonce-based CSP names no external origin, a unit
test fails if any network directive gains one, and a second test fails
if a tracking package appears in package.json. The end-to-end test
drives the standalone server the Docker image runs, not `next dev`,
so a proxy matcher that stopped matching could not pass unnoticed.

Environment is validated at import, so a missing DATABASE_URL fails at
boot with a readable message instead of surfacing later as a driver
error mid-export. ENCRYPTION_KEY is checked to be 32 bytes.

Three deviations from the plan, recorded in PLAN.md and README:
Next 16 rather than 15, `proxy.ts` rather than the now-deprecated
`middleware.ts`, and database-backed sessions rather than Auth.js v5,
which is still beta and whose JWTs would make the session revocation
required by compliance item 23 awkward.

Verified locally against PostgreSQL 16: migrations apply, extensions
created, typecheck, lint, 9 unit tests and the end-to-end header test
all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv

src/server/db.ts

@@ -0,0 +1,31 @@
+import { PrismaPg } from '@prisma/adapter-pg';
+import { PrismaClient } from '@prisma/client';
+
+import { env } from '@/lib/env';
+
+/**
+ * Prisma client singleton.
+ *
+ * WP-01 wraps this with the tenant-scoping extension required by PLAN.md §3.1,
+ * so every query is filtered by the session's account and scope, with
+ * PostgreSQL row-level security behind it as defence in depth. Nothing outside
+ * this module should construct a client.
+ */
+const globalForPrisma = globalThis as unknown as {
+  prisma: PrismaClient | undefined;
+};
+
+function createClient(): PrismaClient {
+  const adapter = new PrismaPg({ connectionString: env.DATABASE_URL });
+
+  return new PrismaClient({
+    adapter,
+    log: env.NODE_ENV === 'development' ? ['warn', 'error'] : ['error'],
+  });
+}
+
+export const prisma = globalForPrisma.prisma ?? createClient();
+
+if (env.NODE_ENV !== 'production') {
+  globalForPrisma.prisma = prisma;
+}

src/server/health.ts

@@ -0,0 +1,19 @@
+import { prisma } from '@/server/db';
+
+export interface HealthResult {
+  ok: boolean;
+  error?: string;
+}
+
+/** Round-trips a trivial query so the landing page reports real connectivity. */
+export async function checkDatabase(): Promise<HealthResult> {
+  try {
+    await prisma.$queryRaw`SELECT 1`;
+    return { ok: true };
+  } catch (error) {
+    return {
+      ok: false,
+      error: error instanceof Error ? error.message : 'erreur inconnue',
+    };
+  }
+}