feat: initial HELIX scaffold — R&D showcase platform

SvelteKit 2 + Svelte 5 + TypeScript site. SQLite via Drizzle. Gitea OAuth
for authoring (RnD org-gated). Pure SVG + CSS DNA helix on landing.

What lands
- Landing hero with animated two-strand SVG helix + tagline
- /projects + /projects/[slug] (markdown body, dashboard embed allowlist)
- /posts + /posts/[slug]
- Auth-gated /projects/new + /posts/new forms
- Gitea OAuth flow (state, code exchange, org-membership check, sessions)
- Sliding-window cookie sessions (SHA-256 hashed token storage)
- Dockerfile + docker-compose with named-volume SQLite
- Idempotent seed (EVOLV + HELIX projects, welcome post)

Stack notes
- Tailwind v3 (Node 18 compat; v4 needs Node 20+)
- drizzle-orm 0.45+ (patched, no SQL-identifier escape vuln)
- marked for markdown; iframe embeds gated by DASHBOARD_ALLOWED_HOSTS

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,22 @@
+services:
+  helix:
+    build: .
+    container_name: helix
+    restart: unless-stopped
+    ports:
+      - "${HELIX_PORT:-3000}:3000"
+    environment:
+      NODE_ENV: production
+      PORT: 3000
+      ORIGIN: ${ORIGIN:-http://localhost:3000}
+      DATABASE_URL: /data/helix.db
+      GITEA_BASE_URL: ${GITEA_BASE_URL:-https://gitea.wbd-rd.nl}
+      GITEA_CLIENT_ID: ${GITEA_CLIENT_ID}
+      GITEA_CLIENT_SECRET: ${GITEA_CLIENT_SECRET}
+      GITEA_REDIRECT_URI: ${GITEA_REDIRECT_URI:-http://localhost:3000/auth/gitea/callback}
+      GITEA_ALLOWED_ORG: ${GITEA_ALLOWED_ORG:-RnD}
+    volumes:
+      - helix-data:/data
+
+volumes:
+  helix-data: