feat: complete Phase 1 foundation scaffold

- Monorepo: Turborepo + pnpm workspaces with 7 apps/packages
- Backend: NestJS scaffold with 9 modules (auth, tenant, curriculum, simulation, portfolio, ai-coach, analytics, classroom, gamification)
- Frontend: React 18 + Vite + TailwindCSS + shadcn/ui with 10 pages, 14 UI primitives, 3 Zustand stores
- Database: Prisma schema with 19 models, 13 enums, seed script, multi-tenant ready
- Docker: Dev, production, and Portainer Compose files with Traefik reverse proxy
- Configuration: .env.example (47 vars), Zod validation, frontend-safe env exposure
- i18n: English + Greek locale files (10 files), ICU MessageFormat, react-i18next
- Shared packages: @investplay/types, @investplay/ui, @investplay/i18n, @investplay/utils
- CI/CD: GitHub Actions (lint, typecheck, test, build, deploy, PR checks)
- Documentation: CONTEXT.md, ARCHITECTURE.md (10 Mermaid diagrams), API.md, LOCALIZATION.md, DEVELOPMENT-ROADMAP.md
- Infrastructure: Dockerfiles (dev + prod), nginx configs, backup/healthcheck scripts
- Security: JWT auth guards, role-based access, rate limiting, Helmet, CORS, PII sanitization

apps/web/nginx.conf

@@ -0,0 +1,125 @@
+worker_processes auto;
+worker_rlimit_nofile 65535;
+
+events {
+  multi_accept on;
+  worker_connections 65535;
+  use epoll;
+}
+
+http {
+  charset utf-8;
+  sendfile on;
+  tcp_nopush on;
+  tcp_nodelay on;
+  server_tokens off;
+  log_not_found off;
+  types_hash_max_size 2048;
+  client_max_body_size 100M;
+
+  # MIME types
+  include mime.types;
+  default_type application/octet-stream;
+
+  # Logging
+  access_log /var/log/nginx/access.log combined buffer=512k flush=1m;
+  error_log /var/log/nginx/error.log warn;
+
+  # Timeouts
+  keepalive_timeout 65;
+  keepalive_requests 100;
+  client_body_timeout 60;
+  client_header_timeout 60;
+  send_timeout 60;
+
+  # Gzip compression
+  gzip on;
+  gzip_vary on;
+  gzip_proxied any;
+  gzip_comp_level 6;
+  gzip_min_length 256;
+  gzip_types
+    application/javascript
+    application/json
+    application/manifest+json
+    application/xml
+    image/svg+xml
+    text/css
+    text/javascript
+    text/plain
+    text/xml;
+
+  # Cache static assets with hashed filenames
+  location ~* \.(?:css|js|map|json)$ {
+    root /usr/share/nginx/html;
+    expires 1y;
+    access_log off;
+    add_header Cache-Control "public, immutable, max-age=31536000";
+  }
+
+  # Cache images, fonts, media
+  location ~* \.(?:gif|jpe?g|png|webp|avif|ico|svg|woff2?|eot|ttf|otf)$ {
+    root /usr/share/nginx/html;
+    expires 1y;
+    access_log off;
+    add_header Cache-Control "public, immutable, max-age=31536000";
+  }
+
+  # Security headers
+  add_header X-Frame-Options "DENY" always;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+  add_header X-XSS-Protection "1; mode=block" always;
+  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+  add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
+
+  # API proxy
+  location /api/ {
+    proxy_pass http://api:3001/;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host $host;
+    proxy_read_timeout 90;
+    proxy_buffering off;
+  }
+
+  location /graphql {
+    proxy_pass http://api:3001/graphql;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 90;
+    proxy_buffering off;
+  }
+
+  # SPA fallback
+  root /usr/share/nginx/html;
+  index index.html;
+
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+
+  # Deny access to hidden files
+  location ~ /\. {
+    deny all;
+    access_log off;
+    log_not_found off;
+  }
+
+  # Deny access to sensitive paths
+  location ~ ^/(\.env|\.git|node_modules|dist) {
+    deny all;
+    access_log off;
+    log_not_found off;
+  }
+}