Issue 17: StartOS 0.4.0 packaging

- Dockerfile: multi-stage build (Node frontend + Python backend)
- StartOS manifest, interfaces, backups, version graph
- start.sh: auto-generates session secret, creates first approver on boot
- Backend serves built frontend as SPA in production
- Single data volume for SQLite DB, platform backups cover it

deploy/startos/main.ts

@@ -0,0 +1,39 @@
+import { sdk } from './sdk'
+
+const appPort = 8000
+
+export const main = sdk.setupMain(async ({ effects }) => {
+  console.info('Starting Ten31Portal')
+
+  const subcontainer = await sdk.SubContainer.of(
+    effects,
+    { imageId: 'main' },
+    sdk.Mounts.of().mountVolume({
+      volumeId: 'main',
+      subpath: null,
+      mountpoint: '/data',
+      readonly: false,
+    }),
+    'ten31portal-sub',
+  )
+
+  return sdk.Daemons.of(effects).addDaemon('primary', {
+    subcontainer,
+    exec: {
+      command: ['sh', '-c', '/app/start.sh'],
+      env: {
+        TEN31_DB_PATH: '/data/portal.db',
+        TEN31_SESSION_SECRET: process.env.TEN31_SESSION_SECRET || 'change-me',
+      },
+    },
+    ready: {
+      display: 'Web Interface',
+      fn: () =>
+        sdk.healthCheck.checkPortListening(effects, appPort, {
+          successMessage: 'Ten31Portal is ready',
+          errorMessage: 'Ten31Portal is starting...',
+        }),
+    },
+    requires: [],
+  })
+})