feat(M1): Project scaffolding, DB schema, core infrastructure

- Initialize Rust workspace with 7 crates (pm-web, pm-worker, pm-core,
  pm-agent-client, pm-auth, pm-ca, pm-reports)
- React + TypeScript + Vite + MUI frontend scaffold
- Full PostgreSQL schema: all 17 tables with indexes and constraints
- pm-core: config (TOML+env), db (SQLx pool + migrations), error
  (unified AppError + JSON envelope), request_id (ULID middleware),
  logging (tracing JSON/pretty)
- pm-web: Axum skeleton, /status/health endpoint, static file serving
- pm-worker: Tokio skeleton, heartbeat writer, schema version check
- Embedded sqlx migrations with advisory lock (single-writer)
- systemd unit files, setup.sh, build-frontend.sh
- config.example.toml with all configuration keys
- docs/runbooks/restore.md
- cargo check passes with zero warnings

Closes M1.

scripts/build-frontend.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# =============================================================================
+# Linux Patch Manager — Frontend Build Script
+# =============================================================================
+# Builds the React + TypeScript SPA and copies output to the system frontend dir.
+# Run from the repository root.
+# =============================================================================
+
+set -euo pipefail
+
+GREEN='\033[0;32m'
+RED='\033[0;31m'
+NC='\033[0m'
+
+info()  { echo -e "${GREEN}[INFO]${NC}  $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+FRONTEND_DIR="${REPO_ROOT}/frontend"
+DEST_DIR="${1:-/usr/share/patch-manager/frontend}"
+
+info "Building React SPA..."
+cd "${FRONTEND_DIR}"
+
+# Install dependencies if node_modules not present
+if [[ ! -d node_modules ]]; then
+    info "Installing npm dependencies..."
+    npm ci
+fi
+
+# Build
+info "Running vite build..."
+npm run build
+
+# Deploy to destination
+info "Copying build output to ${DEST_DIR}..."
+mkdir -p "${DEST_DIR}"
+rm -rf "${DEST_DIR:?}/"
+cp -r dist/* "${DEST_DIR}/"
+
+info "Frontend build complete → ${DEST_DIR}"