feat: Phase 1 scaffold — frontend canvas + backend skeleton

Frontend:
- Vite + React 18 + TypeScript + Tailwind v4 + Shadcn/ui
- React Flow v12 canvas with all 11 node types and 5 edge types
- Dark theme with project design system (cyan, green, orange, purple accents)
- Collapsible sidebar, toolbar, detail panel
- Zustand store for canvas state
- Demo data with 10 nodes and 10 edges

Backend:
- FastAPI + SQLAlchemy async + SQLite (Python 3.13)
- DB models: Node, Edge, CanvasState, PendingDevice, ScanRun
- REST API routes: auth, nodes, edges, canvas, scan, status (WebSocket)
- JWT auth + bcrypt via config.yml
- Pydantic v2 schemas

Infra:
- GitHub Actions quality + security workflows
- .gitignore, .env.example, verify-tooling.sh, security-check.sh

scripts/security-check.sh

@@ -0,0 +1,41 @@
+#!/bin/bash
+set -e
+
+echo "Running security checks..."
+
+# Check .env is not staged
+if git diff --cached --name-only | grep -E '^\.env$|^\.env\.' | grep -v '\.example$'; then
+  echo "ERROR: .env file is staged for commit!"
+  exit 1
+fi
+
+# Check for common secret patterns in staged files
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
+if [ -n "$STAGED_FILES" ]; then
+  if echo "$STAGED_FILES" | xargs grep -l -E '(password|secret|api_key|apikey|token)\s*[:=]\s*["\047][^"\047]{8,}["\047]' 2>/dev/null; then
+    echo "WARNING: Possible secrets found in staged files - please verify"
+  fi
+fi
+
+# Check for SQLite DB being committed
+if git diff --cached --name-only | grep -E '\.db$'; then
+  echo "ERROR: SQLite database file is staged for commit!"
+  exit 1
+fi
+
+# Dependency audit (frontend)
+if [ -f "frontend/package.json" ]; then
+  echo "Checking npm dependencies..."
+  cd frontend && npm audit --audit-level=high 2>/dev/null || echo "Warning: npm audit found issues"
+  cd ..
+fi
+
+# Python dependency check
+if [ -f "backend/requirements.txt" ]; then
+  if command -v safety &> /dev/null; then
+    echo "Checking Python dependencies..."
+    safety check -r backend/requirements.txt 2>/dev/null || echo "Warning: safety found issues"
+  fi
+fi
+
+echo "Security checks complete!"

scripts/verify-tooling.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+set -e
+
+echo "Verifying project tooling..."
+
+# GitHub CLI
+if command -v gh &> /dev/null; then
+  if gh auth status &> /dev/null; then
+    echo "✓ GitHub CLI authenticated"
+  else
+    echo "✗ GitHub CLI not authenticated. Run: gh auth login"
+    exit 1
+  fi
+else
+  echo "⚠ GitHub CLI not installed. Run: brew install gh"
+fi
+
+# Python
+if command -v python3 &> /dev/null; then
+  echo "✓ Python $(python3 --version)"
+else
+  echo "✗ Python not installed"
+  exit 1
+fi
+
+# Node
+if command -v node &> /dev/null; then
+  echo "✓ Node $(node --version)"
+else
+  echo "✗ Node not installed"
+  exit 1
+fi
+
+# nmap (required for scanner service)
+if command -v nmap &> /dev/null; then
+  echo "✓ nmap $(nmap --version | head -1)"
+else
+  echo "⚠ nmap not installed. Run: brew install nmap  (required for scanner)"
+fi
+
+# Docker
+if command -v docker &> /dev/null; then
+  echo "✓ Docker $(docker --version)"
+else
+  echo "⚠ Docker not installed. Required for production deployment."
+fi
+
+echo ""
+echo "Tooling verification complete!"