feat: initial scaffold - backend, frontend, Prisma schema, Docker

- Prisma schema: User, Session, RepoConfig, Preview, Job, WebhookToken, NoConfigComment, AdminSettings
- Backend: auth (login/logout/me/first-user setup), webhook handler with HMAC verification, EC2 service, SSH service, deploy pipeline, job queue worker, cron workers
- Frontend: Login with first-user detection, Dashboard, PreviewDetail with live log streaming, Settings, Repos config, Admin panel, SetupWizard, Privacy page
- Docker Compose and Dockerfile for self-hosted deployment
- Uses bcryptjs for Node 24 compatibility

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/pages/Privacy.tsx

@@ -0,0 +1,41 @@
+import React from "react";
+import { Link } from "react-router-dom";
+
+export function Privacy() {
+  return (
+    <div className="max-w-2xl prose dark:prose-invert">
+      <Link to="/" className="text-sm text-blue-600 dark:text-blue-400 hover:underline mb-4 inline-block">← Back</Link>
+      <h1>Privacy Policy</h1>
+      <p>This is a self-hosted instance of PR Previews (PP). The following describes what data PP stores and how it is used.</p>
+
+      <h2>What We Store</h2>
+      <ul>
+        <li>Your username and hashed password.</li>
+        <li>Your Gitea Personal Access Token (PAT), encrypted at rest with AES-256.</li>
+        <li>Your AWS Access Key ID and Secret Access Key, encrypted at rest with AES-256.</li>
+        <li>Preview logs, PR metadata (PR number, title, commit SHA), and EC2 instance details.</li>
+        <li>SSH private keys (ephemeral per launch, encrypted at rest, deleted on instance termination).</li>
+      </ul>
+
+      <h2>How We Use Your Data</h2>
+      <ul>
+        <li>Your Gitea PAT is used solely to register webhooks, clone repositories, and post preview status comments on PRs.</li>
+        <li>Your AWS credentials are used solely to provision EC2 instances for previews in your own AWS account.</li>
+        <li>PP does not have access to data on EC2 instances beyond what it deploys.</li>
+        <li>No data is shared with third parties.</li>
+      </ul>
+
+      <h2>Data Retention</h2>
+      <p>Preview records are retained for the number of days configured by the administrator (default: 30 days after a preview is stopped or failed). You can view this setting in the admin panel.</p>
+
+      <h2>EC2 Instances</h2>
+      <p>Preview instances are launched in your own AWS account. PP terminates them on PR close, inactivity timeout, or manual stop. PP does not retain any data from inside EC2 instances.</p>
+
+      <h2>Analytics & Tracking</h2>
+      <p>No analytics, no tracking, no external data sharing. PP is fully self-contained.</p>
+
+      <h2>Contact</h2>
+      <p>For questions or concerns, contact the instance administrator.</p>
+    </div>
+  );
+}