feat: monorepo with NestJS API, admin panel and DB-driven website

Restructure the repo into a pnpm + Turborepo monorepo:

- apps/web: Nuxt 4 site, now server-rendered and reading all content
  from the API; pages cached with SWR and purged on content changes
- apps/api: NestJS 12 + Prisma 7 + PostgreSQL. Auth with short-lived
  access tokens and rotating httpOnly refresh cookies, roles (ADMIN,
  EDITOR), catalog, editable site sections, media upload to S3-compatible
  storage (converted to WebP), contact messages, audit log
- apps/admin: Vue 3 admin panel (Ant Design Vue, Pinia, Tailwind) for
  products, categories, site sections, messages, media and users
- packages/shared: Zod schemas and types shared by API and admin

Also:
- seed script that loads the original 8 categories / 89 products and
  section content
- Docker images for api (with a one-off migrate service), web, admin,
  and an nginx gateway for both domains
- dev and production compose files, daily database backup service
- API e2e tests

Removes the committed static out/ build and the old root Dockerfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/admin/src/api/http.ts

@@ -0,0 +1,59 @@
+import { FetchError, type FetchOptions, ofetch } from "ofetch";
+import type { ValidationIssue } from "@imen/shared";
+
+/** Raw client without auth handling (login / refresh / logout use it directly) */
+export const rawApi = ofetch.create({ baseURL: "/api", credentials: "include" });
+
+type AuthHooks = {
+  token: () => string;
+  refresh: () => Promise<boolean>;
+  onExpired: () => void;
+};
+let hooks: AuthHooks | null = null;
+
+/** Wired by the auth store, which owns the access token */
+export const setAuthHooks = (h: AuthHooks) => {
+  hooks = h;
+};
+
+/**
+ * Authenticated request. On 401 it refreshes the access token once (using the httpOnly
+ * refresh cookie) and retries; if that fails the session is over.
+ */
+export async function api<T>(url: string, opts: FetchOptions<"json"> = {}, retried = false): Promise<T> {
+  const token = hooks?.token();
+  try {
+    return await rawApi<T>(url, {
+      ...opts,
+      headers: { ...(opts.headers as Record<string, string>), ...(token && { Authorization: `Bearer ${token}` }) },
+    });
+  } catch (e) {
+    if (e instanceof FetchError && e.status === 401 && !retried && hooks) {
+      if (await hooks.refresh()) return api<T>(url, opts, true);
+      hooks.onExpired();
+    }
+    throw e;
+  }
+}
+
+interface ApiErrorBody {
+  message?: string | string[];
+  issues?: ValidationIssue[];
+}
+
+export const errorBody = (e: unknown): ApiErrorBody =>
+  e instanceof FetchError ? ((e.data as ApiErrorBody | undefined) ?? {}) : {};
+
+/** Human-readable (Persian) error message for notifications */
+export function errorMessage(e: unknown): string {
+  if (e instanceof FetchError) {
+    if (!e.status) return "ارتباط با سرور برقرار نشد";
+    const msg = errorBody(e).message;
+    if (Array.isArray(msg)) return msg.join("، ");
+    if (msg) return msg;
+    if (e.status === 413) return "حجم فایل بیش از حد مجاز است";
+    if (e.status === 429) return "تعداد درخواست‌ها زیاد است؛ کمی بعد تلاش کنید";
+    return `خطای سرور (${e.status})`;
+  }
+  return "خطای ناشناخته";
+}