chore: cleanup project structure and resolve client type errors

- resolve all 69 client type-checking errors for stricter TS compliance
- remove obsolete type-check baseline scripts and files
- overhaul project root with updated README.md and new DEVELOPMENT.md
- migrate to unified baseline migration strategy and cleanup docker configs
- remove redundant production and dev-specific shell scripts

.env.example

@@ -0,0 +1,42 @@
+# Immutable image reference built by CI (use a sha-* tag or @sha256 digest)
+APP_IMAGE=ghcr.io/your-org/projectx:sha-<git-sha>
+
+# App publish port on host
+APP_PORT=3000
+
+# Database credentials
+POSTGRES_USER=projectx
+POSTGRES_PASSWORD=change-this-password
+POSTGRES_DB=projectx
+
+# App secrets
+JWT_SECRET=change-this-to-a-long-random-secret
+# Required for the initial /auth/setup endpoint (x-setup-token header)
+SETUP_BOOTSTRAP_TOKEN=change-this-to-a-long-random-secret
+
+# External/public URL used by emails and Kobo endpoints
+APP_URL=https://projectx.example.com
+
+# --- Optional overrides (uncomment to set) ---
+
+# If you already run your own PostgreSQL, set DATABASE_URL and remove the
+# postgres service from docker-compose.yml. Your instance must have the
+# uuid-ossp, pg_trgm, and vector (pgvector) extensions available.
+# DATABASE_URL=postgres://user:password@yourhost:5432/projectx
+# Or set individual parts (POSTGRES_HOST, POSTGRES_PORT, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_DB)
+
+# JWT token lifetimes
+# JWT_EXPIRES_IN=15m
+# JWT_REFRESH_EXPIRES_IN=7d
+
+# CORS origin for the frontend when served from a different domain than APP_URL
+# CLIENT_URL=https://app.example.com
+
+# Staging directory (defaults to {BOOKS_PATH}/staging inside the container)
+# STAGING_PATH=/staging
+
+# AES-256 key for encrypting stored email credentials (generate: openssl rand -hex 32)
+# EMAIL_ENCRYPTION_KEY=
+
+# Log level (default: info). Set to debug for verbose output.
+# LOG_LEVEL=info