Issue 17: StartOS 0.4.0 packaging

- Dockerfile: multi-stage build (Node frontend + Python backend)
- StartOS manifest, interfaces, backups, version graph
- start.sh: auto-generates session secret, creates first approver on boot
- Backend serves built frontend as SPA in production
- Single data volume for SQLite DB, platform backups cover it

deploy/start.sh

@@ -0,0 +1,38 @@
+#!/bin/sh
+set -e
+
+# Generate session secret if not set or default
+if [ "$TEN31_SESSION_SECRET" = "change-me" ]; then
+  if [ -f /data/.session-secret ]; then
+    export TEN31_SESSION_SECRET=$(cat /data/.session-secret)
+  else
+    export TEN31_SESSION_SECRET=$(python3 -c "import secrets; print(secrets.token_hex(32))")
+    echo "$TEN31_SESSION_SECRET" > /data/.session-secret
+    chmod 600 /data/.session-secret
+  fi
+fi
+
+# Create first approver on first boot if no users exist
+if [ ! -f /data/.initialized ]; then
+  echo "First boot: running migrations and creating default approver..."
+
+  # Set default credentials (user can change via CLI later)
+  ADMIN_NAME="${TEN31_ADMIN_NAME:-Admin}"
+  ADMIN_EMAIL="${TEN31_ADMIN_EMAIL:-admin@ten31.com}"
+  ADMIN_PASSWORD="${TEN31_ADMIN_PASSWORD:-changeme}"
+
+  python3 -m ten31portal.cli create-user \
+    --name "$ADMIN_NAME" \
+    --email "$ADMIN_EMAIL" \
+    --role approver \
+    --password "$ADMIN_PASSWORD" || true
+
+  touch /data/.initialized
+  echo "Default approver created: $ADMIN_EMAIL"
+fi
+
+# Serve frontend static files from the backend
+exec uvicorn ten31portal.main:app \
+  --host 0.0.0.0 \
+  --port 8000 \
+  --log-level info