Add Milestones 1 & 2: full-stack POS foundation with admin UI

- Node/Express/TypeScript API under /api/v1 with JWT auth (login, refresh, logout, /me)
- Prisma schema: vendors, users, roles, products, categories, taxes, transactions
- SQLite for local dev; Postgres via docker-compose for production
- Full CRUD routes for vendors, users, categories, taxes, products with Zod validation and RBAC
- Paginated list endpoints scoped per vendor; refresh token rotation
- React/TypeScript admin SPA (Vite): login, protected routing, sidebar layout
- Pages: Dashboard, Catalog (tabbed Products/Categories/Taxes), Users, Vendor Settings
- Shared UI: Table, Modal, FormField, Btn, PageHeader components
- Multi-stage Dockerfile; docker-compose with Postgres healthcheck
- Seed script with demo vendor and owner account
- INSTRUCTIONS.md, ROADMAP.md, .claude/launch.json for dev server config

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/node_modules/merge-descriptors/README.md

@@ -0,0 +1,49 @@
+# merge-descriptors
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Merge objects using descriptors.
+
+```js
+var thing = {
+  get name() {
+    return 'jon'
+  }
+}
+
+var animal = {
+
+}
+
+merge(animal, thing)
+
+animal.name === 'jon'
+```
+
+## API
+
+### merge(destination, source)
+
+Redefines `destination`'s descriptors with `source`'s. The return value is the
+`destination` object.
+
+### merge(destination, source, false)
+
+Defines `source`'s descriptors on `destination` if `destination` does not have
+a descriptor by the same name. The return value is the `destination` object.
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/merge-descriptors.svg
+[npm-url]: https://npmjs.org/package/merge-descriptors
+[travis-image]: https://img.shields.io/travis/component/merge-descriptors/master.svg
+[travis-url]: https://travis-ci.org/component/merge-descriptors
+[coveralls-image]: https://img.shields.io/coveralls/component/merge-descriptors/master.svg
+[coveralls-url]: https://coveralls.io/r/component/merge-descriptors?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/merge-descriptors.svg
+[downloads-url]: https://npmjs.org/package/merge-descriptors