Issue 17: StartOS 0.4.0 packaging

- Dockerfile: multi-stage build (Node frontend + Python backend)
- StartOS manifest, interfaces, backups, version graph
- start.sh: auto-generates session secret, creates first approver on boot
- Backend serves built frontend as SPA in production
- Single data volume for SQLite DB, platform backups cover it

deploy/startos/manifest/index.ts

@@ -0,0 +1,32 @@
+import { setupManifest } from '@start9labs/start-sdk'
+
+export const manifest = setupManifest({
+  id: 'ten31portal',
+  title: 'Ten31Portal',
+  license: 'MIT',
+  packageRepo: 'https://github.com/smallblocks/Ten31Portal',
+  upstreamRepo: 'https://github.com/smallblocks/Ten31Portal',
+  marketingUrl: 'https://ten31.com',
+  donationUrl: 'https://ten31.com',
+  docsUrls: ['https://github.com/smallblocks/Ten31Portal/blob/main/README.md'],
+  description: {
+    short: 'Internal fund administration and valuation sign-off',
+    long: 'System of record for Ten31 entities, holdings, positions, and quarterly valuation sign-off. Replaces Carta for internal use.',
+  },
+  volumes: ['main'],
+  images: {
+    main: {
+      source: { dockerBuild: { dockerfile: './Dockerfile', workdir: '.' } },
+      arch: ['x86_64', 'aarch64'],
+    },
+  },
+  alerts: {
+    install: 'After installation, access the web UI to log in. A default approver account is created on first boot using the configured credentials.',
+    update: null,
+    uninstall: 'Uninstalling will remove all fund data. Create a backup first.',
+    restore: null,
+    start: null,
+    stop: null,
+  },
+  dependencies: {},
+})