Phase 0: backend + frontend scaffold, single-binary build

Implements the Pansy v1 scaffold (epic #20, phase 0).

#1 Backend: Go module (pure-Go, builds with CGO_ENABLED=0), env config,
   gin server with slog + recovery + /api/v1/healthz, modernc SQLite store
   with WAL/busy_timeout/foreign_keys pragmas, embedded numbered-migration
   runner, full initial schema (users, sessions, gardens, garden_shares,
   garden_objects, plants, plantings), domain structs + sentinel errors,
   graceful shutdown.

#2 Frontend: Vite + React 19 + TS (strict) + Tailwind 4 + TanStack
   Router/Query, typed /api/v1 fetch wrapper (ApiError carries status +
   body so later issues can read 409 conflict rows), dev proxy /api -> :8080,
   responsive app shell with stub pages for all five routes.

#3 Single binary: //go:embed of the web build with a committed placeholder,
   SPA fallback (deep links, immutable asset caching, JSON 404 for unmatched
   /api and missing assets), Makefile (web/build/dev/test), README quickstart
   + env var table.

Verified: go build/vet/test clean (CGO off); binary migrates idempotently and
serves healthz; web tsc + build clean; integrated binary serves the SPA, deep
links, and correct cache headers; app mounts and navigates all five routes at
desktop and 375px widths.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

README.md

@@ -4,3 +4,57 @@ Self-hostable garden planner: drag beds, bags, and containers onto a real-scale
 
 See [DESIGN.md](DESIGN.md) for the architecture. Work is tracked in this repo's issues — start from the tracking epic.
 
+## Quickstart
+
+**Prerequisites:** Go 1.26+, Node 20+.
+
+### Develop
+
+Run the Go API and the Vite dev server together (Vite proxies `/api` → the API):
+
+```sh
+make dev
+```
+
+Then open http://localhost:5173. Or run the two halves in separate terminals for independent restarts:
+
+```sh
+make dev-api   # Go API on :8080
+make dev-web   # Vite dev server on :5173
+```
+
+### Build & run
+
+Produce the single static binary with the web build embedded, then run it:
+
+```sh
+make build
+./pansy
+```
+
+Open http://localhost:8080 — one process serves both the JSON API and the app.
+
+### Test
+
+```sh
+make test
+```
+
+## Configuration
+
+All configuration is via environment variables; every value has a default, so `./pansy` runs with none set.
+
+| Variable                  | Default            | Description                                                        |
+| ------------------------- | ------------------ | ------------------------------------------------------------------ |
+| `PANSY_PORT`              | `8080`             | TCP port the HTTP server listens on.                               |
+| `PANSY_DB`                | `./pansy.db`       | SQLite database file path (created if absent).                     |
+| `PANSY_BASE_URL`          | *(empty)*          | Externally-visible base URL; used to derive the OIDC redirect URI. |
+| `PANSY_REGISTRATION`      | `open`             | `open` or `closed` — gates local self-service signup.              |
+| `PANSY_LOCAL_AUTH`        | `true`             | Enable local password auth. Set `false` for pure-OIDC.            |
+| `PANSY_OIDC_ISSUER`       | *(empty)*          | OIDC issuer/discovery URL (Authentik). Enables SSO when set.       |
+| `PANSY_OIDC_CLIENT_ID`    | *(empty)*          | OIDC client ID.                                                    |
+| `PANSY_OIDC_CLIENT_SECRET`| *(empty)*          | OIDC client secret.                                                |
+| `PANSY_OIDC_BUTTON_LABEL` | `Sign in with SSO` | Label for the OIDC button on the login page.                      |
+| `PANSY_TRUSTED_PROXIES`   | *(none)*           | Comma-separated proxy CIDRs/IPs to trust for client-IP resolution. |
+
+Auth variables are read at startup now and consumed as the auth features land (issues #4/#5).