chore: initial Vector 2.0 monorepo

Ground-up TypeScript rewrite of the Vector hardware parts inventory
system. Ships the full roadmap (Phases 0-8) in one initial commit:

- pnpm + Turbo monorepo: apps/{api,web,e2e}, packages/{db,shared,ui,config}
- Express 5 + Prisma 5 + zod validation + JWT w/ refresh-token rotation
- React 19 + Vite + shadcn/ui + TanStack Query/Table + nuqs URL state
- Repair/RMA, tags, bulk ops, saved views, CSV audit export
- Analytics dashboard on Recharts + EOL tracking
- Signed webhook subscriptions (HMAC-SHA256) with in-process emitter
- Vitest unit tests (shared schemas, api services/helpers) + Playwright skeleton
- Gitea Actions CI (lint, typecheck, test+coverage, build) + Renovate

Deferred follow-ups: Postgres cutover (data-migration script ready),
BullMQ worker for webhook delivery, @react-pdf PDF export, CSV import wizard.

apps/e2e/tests/login.spec.ts

@@ -0,0 +1,28 @@
+import { expect, test } from '@playwright/test';
+
+// Requires a dev user. Set TEST_USERNAME / TEST_PASSWORD in the environment; otherwise the test skips.
+const username = process.env.TEST_USERNAME;
+const password = process.env.TEST_PASSWORD;
+
+test.describe('login', () => {
+  test.skip(!username || !password, 'TEST_USERNAME/TEST_PASSWORD not set');
+
+  test('logs in and lands on the dashboard', async ({ page }) => {
+    await page.goto('/login');
+    await page.getByLabel(/username/i).fill(username!);
+    await page.getByLabel(/password/i).fill(password!);
+    await page.getByRole('button', { name: /sign in|log in/i }).click();
+
+    await expect(page).toHaveURL(/\/(?!login)/, { timeout: 10_000 });
+    await expect(page.getByRole('heading', { name: /dashboard/i })).toBeVisible();
+  });
+
+  test('shows an error on bad credentials', async ({ page }) => {
+    await page.goto('/login');
+    await page.getByLabel(/username/i).fill('does-not-exist');
+    await page.getByLabel(/password/i).fill('wrong-password');
+    await page.getByRole('button', { name: /sign in|log in/i }).click();
+
+    await expect(page.getByText(/invalid|incorrect|unauthor/i)).toBeVisible();
+  });
+});