Add TypeScript + Express + Postgres backend with Better Auth

Implements the first temetro backend: an Express 5 API on Postgres via
Drizzle ORM, with authentication and multi-tenant clinics powered by
Better Auth.

- Auth: email/password with required email verification, password reset,
  rate limiting, CSRF/trusted-origins, secure cookies, session audit hook.
- Organizations (clinics) with RBAC (owner/admin/member/viewer) and an
  extended `patient` permission set; member invitations by email.
- Org-scoped patient records mirroring the frontend Patient shape, with
  CRUD endpoints gated by permission (read/write/delete).
- Email helper logs links to the console when SMTP is unset (zero-setup
  local dev); Dockerfile + docker-compose (db + backend + frontend) with
  migrations applied on startup and a configurable Postgres host port.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/migrate.ts

@@ -0,0 +1,18 @@
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+
+import { db, pool } from "./db/index.js";
+
+// Applies the SQL migrations in ./drizzle at container/app startup. Uses the
+// drizzle-orm runtime migrator (a production dependency) so no dev tooling is
+// needed in the runtime image.
+async function main(): Promise<void> {
+  console.log("Applying database migrations…");
+  await migrate(db, { migrationsFolder: "./drizzle" });
+  console.log("Migrations up to date.");
+  await pool.end();
+}
+
+main().catch((err) => {
+  console.error("Migration failed:", err);
+  process.exit(1);
+});