feat: Phase 1 scaffold — frontend canvas + backend skeleton

Frontend:
- Vite + React 18 + TypeScript + Tailwind v4 + Shadcn/ui
- React Flow v12 canvas with all 11 node types and 5 edge types
- Dark theme with project design system (cyan, green, orange, purple accents)
- Collapsible sidebar, toolbar, detail panel
- Zustand store for canvas state
- Demo data with 10 nodes and 10 edges

Backend:
- FastAPI + SQLAlchemy async + SQLite (Python 3.13)
- DB models: Node, Edge, CanvasState, PendingDevice, ScanRun
- REST API routes: auth, nodes, edges, canvas, scan, status (WebSocket)
- JWT auth + bcrypt via config.yml
- Pydantic v2 schemas

Infra:
- GitHub Actions quality + security workflows
- .gitignore, .env.example, verify-tooling.sh, security-check.sh

backend/app/main.py

@@ -0,0 +1,41 @@
+from contextlib import asynccontextmanager
+
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+from app.core.config import settings
+from app.db.database import init_db
+from app.api.routes import auth, nodes, edges, canvas, scan, status
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    await init_db()
+    yield
+
+
+app = FastAPI(
+    title="Homelable API",
+    version="0.1.0",
+    lifespan=lifespan,
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=settings.cors_origins,
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+app.include_router(auth.router, prefix="/api/v1/auth", tags=["auth"])
+app.include_router(nodes.router, prefix="/api/v1/nodes", tags=["nodes"])
+app.include_router(edges.router, prefix="/api/v1/edges", tags=["edges"])
+app.include_router(canvas.router, prefix="/api/v1/canvas", tags=["canvas"])
+app.include_router(scan.router, prefix="/api/v1/scan", tags=["scan"])
+app.include_router(status.router, prefix="/api/v1/status", tags=["status"])
+
+
+@app.get("/api/v1/health")
+async def health():
+    return {"status": "ok"}