Initial CloudLink scaffold: E2E encrypted PWA with messaging and cloud drive

- Zero-knowledge architecture: all encryption/decryption client-side via Web Crypto API
- AES-GCM 256 for messages, files, and key wrapping; PBKDF2 for password-based key derivation
- Node.js/TypeScript backend: JWT auth with refresh rotation, argon2id passwords, TOTP 2FA
- PostgreSQL schema: encrypted blobs only, server never stores plaintext
- Real-time messaging via WebSocket relay (server routes ciphertext, cannot read it)
- Encrypted file upload/download with per-file keys wrapped by user master key
- React PWA frontend: Vite + Tailwind + service worker for offline support
- Docker Compose: postgres + backend + frontend + nginx with TLS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,18 @@
+# Copy to .env and fill in values — never commit .env
+
+# Database
+POSTGRES_DB=cloudlink
+POSTGRES_USER=cloudlink
+POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
+
+# JWT secrets — generate with: openssl rand -base64 64
+JWT_SECRET=CHANGE_ME
+JWT_REFRESH_SECRET=CHANGE_ME_DIFFERENT
+
+# Server
+HOST_PORT=443
+MAX_FILE_SIZE_MB=100
+
+# Frontend build args (set to your domain)
+VITE_API_URL=https://yourdomain.com/api
+VITE_WS_URL=wss://yourdomain.com/ws