Bootstrap monorepo: Hono API, React PWA, Drizzle DB, CI/CD

Sets up the initial project structure for groombook/groombook:

- pnpm monorepo with apps/api (Hono + TypeScript), apps/web (React + Vite + PWA), packages/db (Drizzle ORM), packages/types (shared types)
- Core DB schema: clients, pets, services, appointments, staff with CNPG-compatible Postgres
- REST API routes for clients, pets, services, appointments with Zod validation
- OIDC auth middleware for Authentik integration
- React PWA with vite-plugin-pwa, service worker, offline caching, installable manifest
- GitHub Actions CI: lint, typecheck, test, build, Docker image build (groombook-runners)
- Dockerfiles for API (Node.js) and Web (nginx)
- docker-compose.yml for local development

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/middleware/auth.ts

@@ -0,0 +1,45 @@
+import type { MiddlewareHandler } from "hono";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+
+// Authentik OIDC configuration — loaded from env at startup
+const OIDC_ISSUER = process.env.OIDC_ISSUER;
+const OIDC_AUDIENCE = process.env.OIDC_AUDIENCE;
+
+let jwks: ReturnType<typeof createRemoteJWKSet> | null = null;
+
+function getJwks() {
+  if (!OIDC_ISSUER) throw new Error("OIDC_ISSUER is not set");
+  if (!jwks) {
+    jwks = createRemoteJWKSet(
+      new URL(`${OIDC_ISSUER}/application/o/groombook/jwks/`)
+    );
+  }
+  return jwks;
+}
+
+export interface JwtPayload {
+  sub: string;
+  email?: string;
+  name?: string;
+}
+
+export const authMiddleware: MiddlewareHandler = async (c, next) => {
+  const authorization = c.req.header("Authorization");
+  if (!authorization?.startsWith("Bearer ")) {
+    return c.json({ error: "Unauthorized" }, 401);
+  }
+
+  const token = authorization.slice(7);
+
+  try {
+    const { payload } = await jwtVerify(token, getJwks(), {
+      issuer: OIDC_ISSUER,
+      audience: OIDC_AUDIENCE,
+    });
+
+    c.set("jwtPayload", payload as JwtPayload);
+    await next();
+  } catch {
+    return c.json({ error: "Invalid or expired token" }, 401);
+  }
+};