feat: complete Phase 1 foundation scaffold

- Monorepo: Turborepo + pnpm workspaces with 7 apps/packages
- Backend: NestJS scaffold with 9 modules (auth, tenant, curriculum, simulation, portfolio, ai-coach, analytics, classroom, gamification)
- Frontend: React 18 + Vite + TailwindCSS + shadcn/ui with 10 pages, 14 UI primitives, 3 Zustand stores
- Database: Prisma schema with 19 models, 13 enums, seed script, multi-tenant ready
- Docker: Dev, production, and Portainer Compose files with Traefik reverse proxy
- Configuration: .env.example (47 vars), Zod validation, frontend-safe env exposure
- i18n: English + Greek locale files (10 files), ICU MessageFormat, react-i18next
- Shared packages: @investplay/types, @investplay/ui, @investplay/i18n, @investplay/utils
- CI/CD: GitHub Actions (lint, typecheck, test, build, deploy, PR checks)
- Documentation: CONTEXT.md, ARCHITECTURE.md (10 Mermaid diagrams), API.md, LOCALIZATION.md, DEVELOPMENT-ROADMAP.md
- Infrastructure: Dockerfiles (dev + prod), nginx configs, backup/healthcheck scripts
- Security: JWT auth guards, role-based access, rate limiting, Helmet, CORS, PII sanitization

apps/cms/Dockerfile

@@ -0,0 +1,35 @@
+FROM node:20-alpine AS deps
+RUN apk add --no-cache libc6-compat
+RUN corepack enable && corepack prepare pnpm@9.15.9 --activate
+WORKDIR /app
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
+COPY apps/cms/package.json apps/cms/tsconfig.json ./apps/cms/
+COPY packages/ ./packages/
+RUN pnpm install --frozen-lockfile --prod --ignore-scripts
+
+FROM node:20-alpine AS builder
+RUN apk add --no-cache libc6-compat python3 make g++
+RUN corepack enable && corepack prepare pnpm@9.15.9 --activate
+WORKDIR /app
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
+COPY apps/cms/package.json apps/cms/tsconfig.json ./apps/cms/
+COPY packages/ ./packages/
+RUN pnpm install --frozen-lockfile
+COPY apps/cms ./apps/cms
+RUN pnpm --filter @investplay/cms build
+
+FROM node:20-alpine AS runner
+RUN apk add --no-cache wget
+RUN addgroup --system --gid 1001 nodejs && adduser --system --uid 1001 nodeuser
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=builder /app/apps/cms/dist ./dist
+COPY --from=builder /app/apps/cms/package.json ./package.json
+COPY --from=builder /app/apps/cms/public ./public
+RUN chown -R nodeuser:nodejs /app
+USER nodeuser
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:3000/health || exit 1
+CMD ["node", "dist/server.js"]

apps/cms/Dockerfile.dev

@@ -0,0 +1,10 @@
+FROM node:20-alpine
+RUN apk add --no-cache libc6-compat
+RUN corepack enable && corepack prepare pnpm@9.15.9 --activate
+WORKDIR /app
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json turbo.json ./
+COPY apps/cms/package.json apps/cms/tsconfig.json ./apps/cms/
+COPY packages/ ./packages/
+RUN pnpm install --frozen-lockfile
+EXPOSE 3000
+CMD ["pnpm", "--filter", "@investplay/cms", "dev"]

apps/cms/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@investplay/cms",
+  "version": "0.1.0",
+  "private": true,
+  "description": "InvestPlay Payload CMS",
+  "scripts": {
+    "dev": "cross-env PAYLOAD_CONFIG_PATH=src/payload.config.ts payload",
+    "build": "cross-env PAYLOAD_CONFIG_PATH=src/payload.config.ts payload build",
+    "lint": "eslint \"src/**/*.ts\" --fix",
+    "typecheck": "tsc --noEmit",
+    "clean": "rimraf dist .turbo"
+  },
+  "dependencies": {
+    "payload": "^3.25.0",
+    "@payloadcms/next": "^3.25.0",
+    "express": "^5.1.0",
+    "dotenv": "^16.4.0",
+    "cross-env": "^7.0.3"
+  },
+  "devDependencies": {
+    "typescript": "^5.8.0",
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.14.0",
+    "eslint": "^8.57.0",
+    "rimraf": "^6.0.0"
+  }
+}