Issue 17: StartOS 0.4.0 packaging

- Dockerfile: multi-stage build (Node frontend + Python backend)
- StartOS manifest, interfaces, backups, version graph
- start.sh: auto-generates session secret, creates first approver on boot
- Backend serves built frontend as SPA in production
- Single data volume for SQLite DB, platform backups cover it

backend/ten31portal/main.py

@@ -1,9 +1,13 @@
 """Ten31Portal FastAPI application."""
 
+import os
 from contextlib import asynccontextmanager
+from pathlib import Path
 
 from fastapi import FastAPI
+from fastapi.staticfiles import StaticFiles
 from starlette.middleware.sessions import SessionMiddleware
+from starlette.responses import FileResponse
 
 from ten31portal.config import SESSION_SECRET
 from ten31portal.db_init import run_migrations
@@ -38,6 +42,17 @@ def health() -> dict[str, str]:
     return {"status": "ok"}
 
 
+# Serve built frontend in production (when static/ dir exists next to the app)
+_static_dir = Path(__file__).resolve().parent.parent / "static"
+if _static_dir.is_dir():
+    @app.get("/{path:path}")
+    async def serve_spa(path: str):
+        file = _static_dir / path
+        if file.is_file():
+            return FileResponse(file)
+        return FileResponse(_static_dir / "index.html")
+
+
 def cli() -> None:
     import uvicorn
     uvicorn.run("ten31portal.main:app", host="0.0.0.0", port=8000, reload=True)