Replace project with current server release and Windows setup

Import the 2026-10-09 source release, Fastify/SQLite backend, restored source
assets, and analytics-enabled server build. Replace files from the previous
release while retaining the existing repository history.

Make builds portable across Windows and Linux, configure local startup,
normalize Windows static asset paths, and fix test fixture cleanup and file
URL handling. Exclude local environment settings, databases, dependencies,
validation output, and TypeScript build cache from version control.

Validation: npm ci, static and server builds, 106 arrival tests, and actual
local HTTP checks passed. The full suite passed 467 of 470 tests; three tests
still require QA fixtures omitted from the supplied release, documented in
README-서버실행.md.

scripts/profile-photo-working-image.mjs

@@ -0,0 +1,32 @@
+/** Node + Pillow CPU fixture check. Does not launch or emulate browser/GPU QA. */
+import assert from 'node:assert/strict';
+import {readFile,readdir,mkdtemp} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import {join} from 'node:path';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import {loadTypescript} from './support/load-typescript.mjs';
+const root=await mkdtemp(join(tmpdir(),'behind-glass-photo-fixtures-'));
+const python=(...args)=>{const r=spawnSync('python',['scripts/support/photo-fixtures.py',...args],{encoding:'utf8'});if(r.status)throw new Error(r.stderr);return JSON.parse(r.stdout);};
+python('generate',root);
+const {createPhotoSnapshot}=await loadTypescript(new URL('../src/input/PhotoSnapshot.ts',import.meta.url));
+const {readPhotoMetadata}=await loadTypescript(new URL('../src/input/PhotoMetadata.ts',import.meta.url));
+const rows=[];let closes=0;
+globalThis.createImageBitmap=async(file,options)=>{assert.ok(options.resizeWidth<=1024&&options.resizeHeight<=1024,'all real fixture headers must enable first-decode bounds');const result=python('inspect',file.fixturePath,String(options.resizeWidth),String(options.resizeHeight));return{...result,close(){closes++;}};};
+for(const name of await readdir(root)){
+  const path=join(root,name),bytes=await readFile(path),hash=createHash('sha256').update(bytes).digest('hex');
+  const blob=new Blob([bytes]);blob.fixturePath=path;
+  const metadata=await readPhotoMetadata(blob),snapshot=await createPhotoSnapshot(blob,rows.length,new AbortController().signal),decoded=snapshot.bitmap;
+  assert.equal(snapshot.width,metadata.width<=metadata.height?Math.round(1024*metadata.width/metadata.height):1024);
+  assert.equal(snapshot.height,metadata.height<=metadata.width?Math.round(1024*metadata.height/metadata.width):1024);
+  assert.equal(decoded.sha256,hash,'original bytes untouched');
+  assert.equal(createHash('sha256').update(await readFile(path)).digest('hex'),hash);
+  if(name.includes('alpha-rotated'))assert.deepEqual(decoded.corners.map(x=>x[3]),[64,255,0,192]);
+  if(name.includes('alpha-mirrored'))assert.deepEqual(decoded.corners.map(x=>x[3]),[64,0,255,192]);
+  if(name.includes('48mp'))assert.deepEqual(decoded.alphaExtrema,[128,128]);
+  snapshot.bitmap.close();
+  const {close,...values}=decoded;
+  rows.push({file:name,...values,pixelReductionPercent:100*(1-values.workingRGBABytes/values.sourceRGBABytes)});
+}
+assert.equal(closes,rows.length);
+console.log(JSON.stringify({verification:'CPU Pillow decoder behind a test double for createImageBitmap; actual TypeScript header/resize pipeline and real JPEG/PNG/WebP fixture bytes. Not browser-native decode, WebGL upload, device memory or FPS.',fixtureDirectory:root,rows},null,2));