Task #526: Off-Replit migration & GitHub-ready cleanup

Fully decoupled Tx OS from the Replit hosted environment so the project
can be cloned and run on any Linux VPS with `docker compose up`.

Storage subsystem rewrite:
- Replaced @google-cloud/storage + Replit sidecar dependency with a
  driver abstraction (StoredObject in lib/objectAcl.ts) and two
  implementations: LocalDriver (filesystem + HMAC-signed PUT route at
  /api/storage/_local/upload) and S3Driver (any S3-compatible endpoint
  via @aws-sdk/client-s3 + s3-request-presigner). Driver auto-selected
  by STORAGE_DRIVER / S3_ENDPOINT env vars.
- Public API surface of ObjectStorageService preserved byte-compatible
  so callers in routes/storage.ts and routes/executive-meetings.ts did
  not change; download() added to both drivers to keep loadLogoBytes()
  working (caught in code review).
- Storage object-authz tests A-L (incl. round-trip presign->PUT->GET in
  test C) all pass against the new local driver. Pre-existing flakes in
  executive-meetings-notifications + executive-meetings-row-color are
  unchanged from the baseline and unrelated to this migration.

Infrastructure:
- Dockerfile (5 targets: deps/build/api/web/migrate). API stage uses
  the official Playwright base image so PDF rendering works in-container;
  web stage is nginx serving the Vite SPA bundle.
- docker-compose.yml: postgres + minio + minio-init (creates buckets) +
  api + web + one-shot migrate runner. Healthchecks on every long-lived
  service.
- docker/nginx.conf: SPA fallback, /api proxy, /api/socket.io websocket
  upgrade ordering.
- .env.example: every runtime env var documented with comments.
- README.md replaces replit.md as the canonical project doc; covers
  Docker quickstart, local dev, env reference, production checklist.
- MIGRATION_REPORT.md: file-by-file diff of what changed and why.

Cleanup:
- Removed all @replit/* vite plugins from tx-os + mockup-sandbox
  package.json + vite.config.ts + pnpm-workspace.yaml catalog.
- Removed @google-cloud/storage and google-auth-library from api-server.
- Deleted attached_assets/ (23MB), sedMkjeJm temp file, stale dist/ and
  *.tsbuildinfo build artefacts, scripts/post-merge.sh.
- Stripped Replit references from threat_model.md (now describes the
  self-hosted topology).
- New comprehensive .gitignore: Replit configs (.replit, replit.nix,
  replit.md), agent state (.local/, .canvas/, .agents/, .cache/, .config/,
  .upm/), local storage/, .env*, build artefacts. .replit and replit.nix
  remain on disk (sandbox-protected) but will not ship to GitHub.
- scripts/src/seed.ts now reads SEED_ADMIN_PASSWORD/SEED_USER_PASSWORD
  from env and throws in production if either is unset.

Drift from plan: replit.md was deleted (per off-Replit scope) so its
"do-not-touch files" preference list is moot. .replit/replit.nix kept on
disk only because they are sandbox-protected from edit/delete in this
environment, but they are git-ignored so they will not appear in a
fresh clone.

.env.example

@@ -0,0 +1,58 @@
+# ============================================================================
+# Tx OS — environment configuration. Copy to `.env` and edit before deploying.
+# Everything in this file is read by docker-compose.yml at `up` time.
+# NEVER commit `.env` — it is gitignored. `.env.example` is the public template.
+# ============================================================================
+
+# --- Web (nginx → API reverse proxy) ----------------------------------------
+# Host port that exposes the SPA. Front this with Caddy/Nginx/Traefik for TLS.
+WEB_PORT=8080
+
+# Public base URL the SPA + API are reachable at (used to build absolute
+# upload URLs for the local-FS storage driver and CORS allow-list checks).
+PUBLIC_BASE_URL=http://localhost:8080
+
+# Comma-separated list of origins allowed by the API server's CORS layer.
+# Must include PUBLIC_BASE_URL and any additional reverse-proxy domains.
+ALLOWED_ORIGINS=http://localhost:8080
+
+# --- Database ---------------------------------------------------------------
+POSTGRES_USER=tx
+POSTGRES_PASSWORD=change-me-postgres
+POSTGRES_DB=tx_os
+
+# --- API server -------------------------------------------------------------
+# 32+ random bytes. Generate with `openssl rand -hex 32`. Required.
+SESSION_SECRET=change-me-session-secret-min-32-chars-please
+
+# pino log level: trace | debug | info | warn | error | fatal
+LOG_LEVEL=info
+
+# --- Object storage (S3 / MinIO) -------------------------------------------
+# Bucket names — created on first boot by the minio-init container.
+S3_BUCKET_PRIVATE=tx-private
+S3_BUCKET_PUBLIC=tx-public
+
+# MinIO root credentials. Used both as MINIO_ROOT_USER/PASSWORD and as the
+# API server's S3 access key. Change before first boot.
+S3_ACCESS_KEY_ID=tx-minio-admin
+S3_SECRET_ACCESS_KEY=change-me-minio-secret-min-20-chars
+
+# Region label is cosmetic for MinIO but @aws-sdk requires one.
+S3_REGION=us-east-1
+
+# --- Seeded demo accounts ---------------------------------------------------
+# Used only by `docker compose run --rm migrate` on first boot. Required in
+# production — the seed script throws if these are unset and NODE_ENV=production.
+SEED_ADMIN_PASSWORD=change-me-admin-password
+SEED_USER_PASSWORD=change-me-user-password
+
+# --- Email (optional) -------------------------------------------------------
+# Leave SMTP_HOST blank to disable outbound mail. The Executive Meetings
+# notifier no-ops when no SMTP config is present.
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASS=
+SMTP_SECURE=false
+SMTP_FROM=Tx OS <noreply@example.com>