feat(phase-1): TapTrack Hub initial scaffold

Full project scaffold for TapTrack Hub — cloud SaaS control plane
for managing on-prem TapTrack school deployments.

## Infrastructure
- Docker Compose: backend (gunicorn+uvicorn), Celery worker + beat,
  frontend (Vite build + nginx), PostgreSQL 15, Redis 7, nginx proxy
- Dockerfile for backend and frontend, nginx reverse proxy config

## Backend (FastAPI + SQLAlchemy async + Celery)
Database schema (10 tables):
  hub_users, schools, licenses, sms_jobs, sms_credit_ledger,
  invoices, invoice_line_items, school_subscriptions,
  support_tickets, ticket_replies, audit_logs, announcements

Auth: JWT (python-jose) + bcrypt + role-based FastAPI dependencies
  (get_current_user, require_super_admin, require_school_admin)

Routers (11): auth, schools, licenses, sms, billing, tickets,
  users, dashboard, school_portal, announcements, sync

Celery tasks (6):
  sms.process_queue, billing.generate_monthly_invoices,
  billing.send_invoice_email, billing.check_overdue,
  license.check_expiry, reports.send_monthly_reports

Services: SMTP email helper (smtplib + Jinja2)
Seed script: creates super admin admin@taptrack.io

## Frontend (Vue 3 + Vite + Pinia + Tailwind CSS)
Router: 14 routes across super admin + school portal layouts
Stores: Pinia auth store with localStorage persistence
API client: full axios client for all backend endpoints
Layouts: AppLayout (super admin), PortalLayout (school), AuthLayout
Components: AppSidebar, PortalSidebar, SidebarItem, KpiCard,
  StatusBadge, ToastStack
Pages: Login, Dashboard, Schools, SchoolDetail, Licenses, SMS,
  Billing, Tickets, TicketDetail, Users, Announcements, 404
Portal pages: Overview, Billing, SMS Reports, Tickets, Profile

## PAUL Planning Files
- .paul/ROADMAP.md: full 15-phase roadmap with detailed scope
- .paul/STATE.md: current position, tech stack, architecture notes
- .paul/phases/01-setup/01-PLAN.md: complete Phase 1 plan (done)
- .paul/phases/02 through 15: README stubs for all future phases

backend/app/routers/announcements.py

@@ -0,0 +1,54 @@
+"""Announcements — super admin creates, all users read."""
+from datetime import datetime, timezone
+from typing import Optional
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, desc, and_
+
+from app.auth.dependencies import require_super_admin, get_current_user
+from app.database import get_db
+from app.models.user import HubUser
+from app.models.announcement import Announcement
+
+router = APIRouter(prefix="/api/announcements", tags=["announcements"])
+
+class AnnouncementCreate(BaseModel):
+    title: str
+    body: str
+    expires_at: Optional[datetime] = None
+
+@router.get("")
+async def list_announcements(
+    current_user: HubUser = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    stmt = select(Announcement).where(
+        and_(Announcement.is_active == True,
+             (Announcement.expires_at == None) | (Announcement.expires_at > datetime.now(timezone.utc)))
+    ).order_by(desc(Announcement.created_at)).limit(10)
+    items = (await db.execute(stmt)).scalars().all()
+    return [{"id": a.id, "title": a.title, "body": a.body, "created_at": a.created_at.isoformat()} for a in items]
+
+@router.post("", status_code=201)
+async def create_announcement(
+    body: AnnouncementCreate,
+    admin: HubUser = Depends(require_super_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    ann = Announcement(title=body.title, body=body.body, created_by=admin.id, expires_at=body.expires_at)
+    db.add(ann)
+    await db.commit()
+    return {"id": ann.id, "title": ann.title, "created_at": ann.created_at.isoformat()}
+
+@router.delete("/{ann_id}", status_code=204)
+async def delete_announcement(
+    ann_id: str,
+    _admin: HubUser = Depends(require_super_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    ann = (await db.execute(select(Announcement).where(Announcement.id == ann_id))).scalar_one_or_none()
+    if not ann:
+        raise HTTPException(404)
+    ann.is_active = False
+    await db.commit()