feat: monorepo with NestJS API, admin panel and DB-driven website

Restructure the repo into a pnpm + Turborepo monorepo:

- apps/web: Nuxt 4 site, now server-rendered and reading all content
  from the API; pages cached with SWR and purged on content changes
- apps/api: NestJS 12 + Prisma 7 + PostgreSQL. Auth with short-lived
  access tokens and rotating httpOnly refresh cookies, roles (ADMIN,
  EDITOR), catalog, editable site sections, media upload to S3-compatible
  storage (converted to WebP), contact messages, audit log
- apps/admin: Vue 3 admin panel (Ant Design Vue, Pinia, Tailwind) for
  products, categories, site sections, messages, media and users
- packages/shared: Zod schemas and types shared by API and admin

Also:
- seed script that loads the original 8 categories / 89 products and
  section content
- Docker images for api (with a one-off migrate service), web, admin,
  and an nginx gateway for both domains
- dev and production compose files, daily database backup service
- API e2e tests

Removes the committed static out/ build and the old root Dockerfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/.env.example

@@ -0,0 +1,38 @@
+# --- server ---
+PORT=4000
+NODE_ENV=development
+# comma-separated origins allowed to call the API from a browser (admin dev server, site)
+CORS_ORIGINS=http://localhost:5173,http://localhost:3000
+
+# --- database (docker-compose.dev.yml) ---
+DATABASE_URL=postgresql://imen:imen@localhost:5433/imen
+
+# --- auth ---
+# generate with: node -e "console.log(require('crypto').randomBytes(48).toString('base64url'))"
+JWT_SECRET=change-me-dev-secret-change-me-dev-secret
+JWT_ACCESS_TTL=15m
+REFRESH_TTL_DAYS=30
+# set to false only when serving the admin over plain http in production
+COOKIE_SECURE=false
+
+# first admin user, created by `pnpm db:seed`
+ADMIN_EMAIL=admin@imenpishgaman.ir
+ADMIN_PASSWORD=ChangeMe123!
+ADMIN_NAME=مدیر سایت
+
+# --- object storage (MinIO in dev, any S3-compatible service in production) ---
+S3_ENDPOINT=http://localhost:9000
+S3_REGION=us-east-1
+S3_BUCKET=imen-media
+S3_ACCESS_KEY=imen
+S3_SECRET_KEY=imen-secret-key
+S3_FORCE_PATH_STYLE=true
+# create the bucket and make it publicly readable on startup (MinIO)
+S3_ENSURE_BUCKET=true
+# public base URL of uploaded files (no trailing slash). "/media" is proxied to the bucket
+# by the site/admin dev servers and by nginx in production, so URLs are the same everywhere
+MEDIA_PUBLIC_URL=/media
+
+# --- website cache revalidation ---
+WEB_REVALIDATE_URL=http://localhost:3000/_internal/revalidate
+REVALIDATE_SECRET=change-me-revalidate-secret