init: M1 scaffolding + M2 organization/clients/services CRUD

- monorepo (npm workspaces): apps/api (Fastify+Prisma+TS), apps/web (Vite+React+TS), packages/shared (zod schemas)
- SSO via auth.queo.ru: jose+JWKS plugin, requireDocPermission(viewer|user|admin)
- DEV_BYPASS_AUTH for local development (hard-checked off in production)
- M2: organization upsert, clients CRUD with search, services catalog with soft-delete
- BigInt -> Number serializer for Prisma money columns
- Embedded Postgres + npm run dev:demo for one-command local boot
- Docker compose for queoserver: postgres + api + web (nginx as ingress proxying /api -> api:3030)
- First migration 0_init committed (prisma migrate diff)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker/docker-compose.yml

@@ -0,0 +1,61 @@
+name: doc-manager
+
+# Деплой на queoserver (192.168.0.158): хостовый Caddy в /etc/caddy/Caddyfile
+# проксирует doc.queo.ru → localhost:3031 (web с внутренним прокси /api/* → api).
+# Локально для разработки используем npm run dev:demo, не этот compose.
+
+services:
+  postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-docmanager}
+      POSTGRES_USER: ${POSTGRES_USER:-docmanager}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-docmanager}
+    volumes:
+      - pg_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-docmanager} -d ${POSTGRES_DB:-docmanager}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  api:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.api
+    restart: unless-stopped
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      NODE_ENV: production
+      PORT: 3030
+      HOST: 0.0.0.0
+      DATABASE_URL: postgresql://${POSTGRES_USER:-docmanager}:${POSTGRES_PASSWORD:-docmanager}@postgres:5432/${POSTGRES_DB:-docmanager}?schema=public
+      AUTH_ISSUER: ${AUTH_ISSUER:-https://auth.queo.ru}
+      AUTH_AUDIENCE: ${AUTH_AUDIENCE:-queo.ru}
+      AUTH_JWKS_URL: ${AUTH_JWKS_URL:-https://auth.queo.ru/.well-known/jwks.json}
+      AUTH_COOKIE_NAME: q_at
+      AUTH_LOGIN_URL: ${AUTH_LOGIN_URL:-https://auth.queo.ru/auth/login}
+      CORS_ORIGINS: ${CORS_ORIGINS:-https://doc.queo.ru}
+      TOCHKA_JWT_KEY: ${TOCHKA_JWT_KEY:-}
+      TOCHKA_WEBHOOK_SECRET: ${TOCHKA_WEBHOOK_SECRET:-}
+      DEFAULT_ORGANIZATION_ID: ${DEFAULT_ORGANIZATION_ID:-00000000-0000-0000-0000-000000000001}
+      DEV_BYPASS_AUTH: "0"
+    expose:
+      - "3030"
+
+  web:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.web
+    restart: unless-stopped
+    depends_on:
+      - api
+    ports:
+      # Хостовый Caddy на queoserver: doc.queo.ru → localhost:3031
+      - "127.0.0.1:3031:80"
+
+volumes:
+  pg_data: