phase-0: foundation, both apps boot end to end

Monorepo (pnpm workspaces) with two deployable apps and three pure packages.

apps/api (Hono on Node): Zod validated env that fails fast and names the problem,
Kysely factories for SQLite and Postgres chosen by DATABASE_URL scheme, portable
migrations covering the whole SPEC section 5 schema, Better Auth with the four
roles and seeded demo accounts, localized error envelope, /healthz and /readyz,
graceful SIGTERM drain. Dialect specific SQL is confined to the two factories.

apps/web (Next.js App Router): locale routed shell in es and en with a language
switcher, sign in screen, and a runtime /api proxy so the browser only ever sees
one origin and cookies stay first party.

packages/i18n ships both catalogs complete; es is generated from COPY.md and a
test re-derives it from the document on every run so it cannot drift.
packages/contracts holds the Zod schemas and the typed client the web app uses.

Verified: 43 vitest tests, 14 Playwright tests on mobile and desktop, typecheck
and lint clean, migrate and seed from a clean database, sign in through the proxy
with CSRF rejection of foreign origins.

Not verified here: docker compose. This user has no access to the docker socket.

RULES.md is absent from docs/, so packages/rules exports only RULES_VERSION and
no tax rule, check digit or deadline was invented. See DECISIONS.md.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/i18n/src/catalogs/es.extra.ts

@@ -0,0 +1,26 @@
+// Strings the product needs that COPY.md does not list. They follow the tone rules in
+// COPY.md section 0: voseo, plain words, never blame the user, no em dashes.
+// Anything COPY.md does define belongs in es.ts and must stay verbatim.
+
+export const esExtra = {
+  // Error envelope. Every non-2xx response carries one of these, localized to the
+  // requester. `internal` reuses common.error.generic.
+  "error.validation_error": "Revisá los datos que cargaste, hay algo que no cierra.",
+  "error.unauthorized":     "Necesitás iniciar sesion para ver esto.",
+  "error.forbidden":        "No tenés permiso para hacer esto.",
+  "error.not_found":        "No encontramos lo que buscabas.",
+  "error.conflict":         "Esto cambio desde la ultima vez que lo viste. Actualizá y probá de nuevo.",
+  "error.rate_limited":     "Probaste muchas veces seguidas. Esperá un momento y volvé a intentar.",
+  "error.ocr_unavailable":  "Por ahora no podemos leer fotos. Cargá la factura a mano.",
+
+  // Auth screens
+  "auth.login.password":    "Tu contraseña",
+  "auth.login.submit":      "Entrar",
+  "auth.login.failed":      "Ese email y esa contraseña no coinciden. Probá de nuevo.",
+  "auth.login.noAccount":   "¿Todavia no tenés cuenta?",
+
+  // Chrome
+  "common.language":        "Idioma",
+  "common.languageEs":      "Español",
+  "common.languageEn":      "English",
+} as const satisfies Record<string, string>;