Modernize project configuration and development tooling

.dockerignore

@@ -1,12 +1,19 @@
 # Node and Python cache
 frontend/node_modules
 frontend/build
+node_modules
 __pycache__/
 *.pyc
 *.pyo
 *.pyd
 backend/venv/
 backend/__pycache__/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.venv/
+htmlcov/
+venv/
 
 # Logs
 logs/
@@ -42,19 +49,14 @@ images/
 
 # CI/CD and linting config (not needed in image)
 .github/
-.pre-commit-config.yaml
-.nvmrc
+prek.toml
 biome.json
-pyproject.toml
-requirements-dev.txt
-requirements-lint.txt
 
 # Specific empty/stub files
 backend/millionaires_vault.py
 backend/mam_vault_discovery.py
 
 # Backup and duplicate files
-*.bak
 *.backup
 *copy.jsx
 *Copy.jsx

.github/workflows/linters.yml

@@ -7,6 +7,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   linters:
     name: Run Linters
@@ -15,55 +18,22 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@v7
 
-      - name: Debug GitHub Variables
-        run: |
-            echo "github.event_name: ${{ github.event_name }}"
-            echo "github.ref_name: ${{ github.ref_name }}"
-            echo "github.event.repository.default_branch: ${{ github.event.repository.default_branch }}"
-
-      - name: Setup Python 3 (with caching)
-        uses: actions/setup-python@v7
-        id: setup-python
-        with:
-          python-version: 3.x
-          cache: 'pip'
-          cache-dependency-path: |
-            requirements-lint.txt
-            pyproject.toml
-
-      - name: Install backend Python linting requirements
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements-lint.txt
-
-      - name: Cache pre-commit and mypy
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cache/pre-commit
-            .mypy_cache
-            .ruff_cache
-          key: ${{ runner.os }}-lint-py${{ steps.setup-python.outputs.python-version || '3.x' }}-${{ hashFiles('**/requirements-lint.txt', '**/.pre-commit-config.yaml', '**/pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-lint-
-
       - name: Setup Node.js (for frontend linting)
         uses: actions/setup-node@v7
         with:
-          node-version: '22.20.0' # LTS
+          node-version: '24.18.0' # LTS
           cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
 
+      - name: Install npm with script approval support
+        run: npm install --global "npm@>=11.16.0" --ignore-scripts --no-audit --no-fund
+
       - name: Install frontend dependencies
         working-directory: frontend
-        run: |
-          npm ci || npm install --no-audit --no-fund
-
-      - name: Run pre-commit
-        uses: pre-commit/action@v3.0.1
+        run: npm ci --strict-allow-scripts --no-fund
 
-      - name: Run mypy
-        run: mypy "./backend/" --install-types --non-interactive --config-file pyproject.toml
+      - name: Run prek
+        uses: j178/prek-action@v2
 
-      - uses: pre-commit-ci/lite-action@v1.1.0
-        if: always()
+      - name: Build frontend production bundle
+        run: npm --prefix frontend run build

.github/workflows/prek_autoupdate.yml

@@ -0,0 +1,18 @@
+name: prek Autoupdate
+
+on:
+  schedule:
+    - cron: '0 4 * * *'
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  prek-autoupdate:
+    uses: Snuffy2/prek-autoupdate/.github/workflows/prek_autoupdate.yml@v1
+    permissions:
+      contents: write
+      pull-requests: write
+    with:
+      update-day: "4"

.gitignore

@@ -45,9 +45,7 @@ proxies.yaml*
 pytest.xml
 pythonenv*
 pyvenv.cfg
-scripts/
 session-*.yaml*
-tests/
 Thumbs.db
 venv.bak/
 venv/

AGENTS.md

@@ -23,9 +23,12 @@ account management.
 - `frontend/`: React/Vite application.
 - `tests/`: Python pytest suite.
 - `docs/`: user and implementation documentation.
+- `scripts/`: local setup, backend launch, lint, and dependency-maintenance
+  helpers; production containers use `start.sh`.
 - `Dockerfile`: production image build.
-- `pyproject.toml`: pytest, coverage, mypy, and Ruff configuration.
-- `.pre-commit-config.yaml`: repository hook configuration.
+- `pyproject.toml`: Python dependencies plus pytest, coverage, mypy, and Ruff
+  configuration.
+- `prek.toml`: repository hook configuration.
 
 ## General Working Rules
 
@@ -81,69 +84,61 @@ account management.
 
 ## Local Setup
 
-Backend setup:
+Set up both backend and frontend development environments:
 
 ```bash
-python3.13 -m venv .venv
-. .venv/bin/activate
-pip install -r requirements-dev.txt
+./scripts/setup.sh
 ```
 
-Frontend setup:
-
-```bash
-# Requires Node.js 22.20.0 or newer.
-npm ci --prefix frontend
-```
+The helper requires Python 3.13 or newer, Node.js 24.18.0 or newer, and npm
+11.16.0 or newer. It creates or reuses `.venv`, installs the Python `dev` dependency
+group, and runs `npm ci` against the frontend lockfile.
 
 The root `package.json` forwards frontend commands into `frontend/`.
 
-## Validation Commands
-
-Run the checks that match the files you changed. For cross-cutting changes, run
-all relevant checks.
-
-Python tests:
+For local source development:
 
 ```bash
-.venv/bin/pytest
-```
-
-Python lint and format:
+# Start only FastAPI with reload.
+npm run backend
 
-```bash
-.venv/bin/ruff check .
-.venv/bin/ruff format --check .
+# Start FastAPI and Vite together with reload.
+npm run dev
 ```
 
-Python type checking:
+The local backend helper defaults `CONFIG_DIR` to the repository's ignored
+`config/` directory. An explicit `CONFIG_DIR` or per-file path override takes
+precedence and can direct configuration, session state, notifications, proxies,
+port-monitor state, and the SQLite event log anywhere, including production's
+`/config`; check overrides before running local commands. Use
+`VITE_BACKEND_PORT` to change the backend port for the combined `npm run dev`
+command; the helper also accepts `PORT` when starting only the backend. Do not
+use `scripts/start-backend.sh` as a production entrypoint.
 
-```bash
-.venv/bin/mypy backend tests
-```
-
-Frontend lint:
+For routine dependency maintenance, run:
 
 ```bash
-npm run lint
+./scripts/update-dependencies.sh
 ```
 
-Frontend type check:
+The helper updates available Python and frontend development dependencies and
+keeps their generated tool configuration synchronized. Review configuration and
+lockfile changes, then run `./scripts/lint.sh` before committing.
 
-```bash
-npm run tsc
-```
+## Validation Commands
 
-Frontend production build:
+Run the checks that match the files you changed. For cross-cutting changes, run
+the same repository-wide checks as CI. Some hooks apply safe fixes and
+formatting changes, so review the working tree afterward.
 
 ```bash
-npm run build
+./scripts/lint.sh
 ```
 
-Pre-commit hooks:
+Python tests:
 
 ```bash
-.venv/bin/pre-commit run --all-files
+.venv/bin/pytest
 ```
 
 Docker build smoke check:

Dockerfile

@@ -1,26 +1,22 @@
 # Stage 1: Build frontend
-# Pin to linux/amd64 so this stage always runs natively on the CI runner.
-# Node.js 22 uses CPU instructions that QEMU cannot emulate, causing SIGILL
-# (exit 132) when building for arm64 under QEMU. The output is pure static
-# files (JS/CSS/HTML), so the build architecture does not matter.
-FROM --platform=linux/amd64 node:22.20.0-alpine AS frontend-build
+# Build on the builder's native platform so Node.js never runs under QEMU.
+# The output is pure static files (JS/CSS/HTML), so it can be copied into
+# images for any target architecture.
+FROM --platform=$BUILDPLATFORM node:krypton-alpine AS frontend-build
 WORKDIR /frontend
 COPY frontend/package*.json ./
+RUN npm install --global "npm@>=11.16.0" --ignore-scripts --no-audit --no-fund \
+    && npm ci --strict-allow-scripts --silent --no-fund
 COPY frontend/ ./
-RUN npm ci --silent \
-    && npm cache clean --force \
-    # Build the frontend using devDependencies (vite, plugins)
-    && npm run build \
-    # Clean up everything except the build output - we only need /frontend/build in the next stage
-    && npm cache clean --force \
-    && rm -rf node_modules src public package*.json
+# Build the frontend using devDependencies (Vite and plugins).
+RUN npm run build
 
 # Stage 2: Backend (FastAPI)
 FROM python:3.13-alpine AS backend
 WORKDIR /app
 
-# Copy requirements first for better caching
-COPY backend/requirements.txt /app/requirements.txt
+# Copy dependency metadata first for better caching.
+COPY pyproject.toml /app/pyproject.toml
 
 # Install system dependencies, create users/groups, and install Python deps
 RUN apk add --no-cache --virtual .build-deps gcc musl-dev libffi-dev \
@@ -29,7 +25,8 @@ RUN apk add --no-cache --virtual .build-deps gcc musl-dev libffi-dev \
     && addgroup -g 1000 appgroup \
     && adduser -u 1000 -G appgroup -D -s /bin/sh appuser \
     && adduser appuser docker \
-    && pip install --no-cache-dir -r /app/requirements.txt \
+    && python -m pip install --no-cache-dir --upgrade "pip>=25.1" \
+    && python -m pip install --no-cache-dir --group runtime \
     && apk del .build-deps \
     && rm -rf /root/.cache/pip /tmp/* /var/cache/apk/*
 
@@ -44,7 +41,6 @@ ENV PYTHONUNBUFFERED=1 \
 
 # Copy the rest of the backend code and config (exclude dev files)
 COPY backend/*.py /app/backend/
-COPY backend/requirements.txt /app/backend/
 COPY backend/app.py logconfig.yaml.template /app/
 # Copy frontend build output and minimal public assets
 COPY --from=frontend-build /frontend/build /app/frontend/build