refactor: convert repository to monorepo with npm workspaces

Restructured the repository into a monorepo to better organize application code
and maintenance scripts.

## Workspace Structure
- web-app: Next.js application (all app code moved from root)
- housekeeping: Database backup and maintenance scripts

## Key Changes
- Moved all application code to web-app/ using git mv
- Moved database scripts to housekeeping/ workspace
- Updated Dockerfile for monorepo build process
- Updated docker-compose files (volume paths: ./web-app/etc/hosts/)
- Updated .gitignore for workspace-level node_modules
- Updated documentation (README.md, CLAUDE.md, CHANGELOG.md)

## Migration Impact
- Root package.json now manages workspaces
- Build commands delegate to web-app workspace
- All file history preserved via git mv
- Docker build process updated for workspace structure

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

web-app/app/lib/validators/pdfValidator.ts

@@ -0,0 +1,46 @@
+/**
+ * Validate that uploaded file is a legitimate PDF
+ * Checks magic bytes, not just MIME type
+ */
+export async function validatePdfFile(file: File): Promise<{ valid: boolean; error?: string }> {
+
+  // Check file size first (quick rejection)
+  const maxFileSizeKB = parseInt(process.env.MAX_PROOF_OF_PAYMENT_UPLOAD_SIZE_KB || '1024', 10);
+  const maxFileSizeBytes = maxFileSizeKB * 1024;
+
+  if (file.size === 0) {
+    return { valid: false, error: 'File is empty' };
+  }
+
+  if (file.size > maxFileSizeBytes) {
+    return { valid: false, error: `File size exceeds ${maxFileSizeKB} KB limit` };
+  }
+
+  // Read file content
+  const arrayBuffer = await file.arrayBuffer();
+  const buffer = Buffer.from(arrayBuffer);
+
+  // Check PDF magic bytes (header signature)
+  // PDF files must start with "%PDF-" (bytes: 25 50 44 46 2D)
+  const header = buffer.toString('utf-8', 0, 5);
+  if (!header.startsWith('%PDF-')) {
+    return { valid: false, error: 'Invalid PDF file format' };
+  }
+
+  // Optional: Check for PDF version (1.0 to 2.0)
+  const version = buffer.toString('utf-8', 5, 8); // e.g., "1.4", "1.7", "2.0"
+  const versionMatch = version.match(/^(\d+\.\d+)/);
+  if (!versionMatch) {
+    return { valid: false, error: 'Invalid PDF version' };
+  }
+
+  // Optional: Verify PDF EOF marker (should end with %%EOF)
+  // Note: Some PDFs have trailing data, so this is lenient
+  const endSection = buffer.toString('utf-8', Math.max(0, buffer.length - 1024));
+  if (!endSection.includes('%%EOF')) {
+    console.warn('PDF missing EOF marker - may be corrupted');
+    // Don't reject, just warn (some valid PDFs have non-standard endings)
+  }
+
+  return { valid: true };
+}