feat(phase-1): TapTrack Hub initial scaffold

Full project scaffold for TapTrack Hub — cloud SaaS control plane
for managing on-prem TapTrack school deployments.

## Infrastructure
- Docker Compose: backend (gunicorn+uvicorn), Celery worker + beat,
  frontend (Vite build + nginx), PostgreSQL 15, Redis 7, nginx proxy
- Dockerfile for backend and frontend, nginx reverse proxy config

## Backend (FastAPI + SQLAlchemy async + Celery)
Database schema (10 tables):
  hub_users, schools, licenses, sms_jobs, sms_credit_ledger,
  invoices, invoice_line_items, school_subscriptions,
  support_tickets, ticket_replies, audit_logs, announcements

Auth: JWT (python-jose) + bcrypt + role-based FastAPI dependencies
  (get_current_user, require_super_admin, require_school_admin)

Routers (11): auth, schools, licenses, sms, billing, tickets,
  users, dashboard, school_portal, announcements, sync

Celery tasks (6):
  sms.process_queue, billing.generate_monthly_invoices,
  billing.send_invoice_email, billing.check_overdue,
  license.check_expiry, reports.send_monthly_reports

Services: SMTP email helper (smtplib + Jinja2)
Seed script: creates super admin admin@taptrack.io

## Frontend (Vue 3 + Vite + Pinia + Tailwind CSS)
Router: 14 routes across super admin + school portal layouts
Stores: Pinia auth store with localStorage persistence
API client: full axios client for all backend endpoints
Layouts: AppLayout (super admin), PortalLayout (school), AuthLayout
Components: AppSidebar, PortalSidebar, SidebarItem, KpiCard,
  StatusBadge, ToastStack
Pages: Login, Dashboard, Schools, SchoolDetail, Licenses, SMS,
  Billing, Tickets, TicketDetail, Users, Announcements, 404
Portal pages: Overview, Billing, SMS Reports, Tickets, Profile

## PAUL Planning Files
- .paul/ROADMAP.md: full 15-phase roadmap with detailed scope
- .paul/STATE.md: current position, tech stack, architecture notes
- .paul/phases/01-setup/01-PLAN.md: complete Phase 1 plan (done)
- .paul/phases/02 through 15: README stubs for all future phases

frontend/src/router/index.ts

@@ -0,0 +1,125 @@
+import { createRouter, createWebHistory } from 'vue-router'
+
+const router = createRouter({
+  history: createWebHistory(),
+  routes: [
+    { path: '/', redirect: '/dashboard' },
+    {
+      path: '/login',
+      name: 'login',
+      component: () => import('@/pages/LoginPage.vue'),
+      meta: { requiresAuth: false },
+    },
+    // Super Admin routes
+    {
+      path: '/dashboard',
+      name: 'dashboard',
+      component: () => import('@/pages/DashboardPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    {
+      path: '/schools',
+      name: 'schools',
+      component: () => import('@/pages/SchoolsPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    {
+      path: '/schools/:id',
+      name: 'school-detail',
+      component: () => import('@/pages/SchoolDetailPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    {
+      path: '/licenses',
+      name: 'licenses',
+      component: () => import('@/pages/LicensesPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    {
+      path: '/sms',
+      name: 'sms',
+      component: () => import('@/pages/SmsPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    {
+      path: '/billing',
+      name: 'billing',
+      component: () => import('@/pages/BillingPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    {
+      path: '/tickets',
+      name: 'tickets',
+      component: () => import('@/pages/TicketsPage.vue'),
+      meta: { requiresAuth: true, layout: 'app' },
+    },
+    {
+      path: '/tickets/:id',
+      name: 'ticket-detail',
+      component: () => import('@/pages/TicketDetailPage.vue'),
+      meta: { requiresAuth: true, layout: 'app' },
+    },
+    {
+      path: '/users',
+      name: 'users',
+      component: () => import('@/pages/UsersPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    {
+      path: '/announcements',
+      name: 'announcements',
+      component: () => import('@/pages/AnnouncementsPage.vue'),
+      meta: { requiresAuth: true, layout: 'app', role: 'super_admin' },
+    },
+    // School Portal routes
+    {
+      path: '/portal',
+      name: 'portal',
+      component: () => import('@/pages/portal/PortalOverviewPage.vue'),
+      meta: { requiresAuth: true, layout: 'portal' },
+    },
+    {
+      path: '/portal/billing',
+      name: 'portal-billing',
+      component: () => import('@/pages/portal/PortalBillingPage.vue'),
+      meta: { requiresAuth: true, layout: 'portal' },
+    },
+    {
+      path: '/portal/sms',
+      name: 'portal-sms',
+      component: () => import('@/pages/portal/PortalSmsPage.vue'),
+      meta: { requiresAuth: true, layout: 'portal' },
+    },
+    {
+      path: '/portal/tickets',
+      name: 'portal-tickets',
+      component: () => import('@/pages/portal/PortalTicketsPage.vue'),
+      meta: { requiresAuth: true, layout: 'portal' },
+    },
+    {
+      path: '/portal/profile',
+      name: 'portal-profile',
+      component: () => import('@/pages/portal/PortalProfilePage.vue'),
+      meta: { requiresAuth: true, layout: 'portal' },
+    },
+    {
+      path: '/:pathMatch(.*)*',
+      name: 'not-found',
+      component: () => import('@/pages/NotFoundPage.vue'),
+    },
+  ],
+})
+
+router.beforeEach((to, _from, next) => {
+  const token = localStorage.getItem('hub_token')
+  const role = localStorage.getItem('hub_role')
+  const requiresAuth = to.meta.requiresAuth !== false
+
+  if (requiresAuth && !token) return next('/login')
+  if (to.name === 'login' && token) {
+    return next(role === 'super_admin' ? '/dashboard' : '/portal')
+  }
+  next()
+})
+
+export default router