build: M1 Dockerized development stack with PHP skeleton, config/logging, Tailwind assets, and wrappers

Implements MeshVault M1 (issues #6–11):

- Four-service Docker Compose stack (nginx, PHP-FPM 8.3, PostgreSQL 17, Node assets)
- Slim 4 + PHP-DI routing with escaped PHP views and production/dev error handling
- Immutable validated AppConfig with redacted diagnostics
- JSON stdout Monolog logging with job-scoped context
- Tailwind CSS v4 deterministic locked builds with template scanning
- POSIX and PowerShell dev wrappers (up/down/test/lint/assets/watch)
- Startup config validation fails before FPM serves as unprivileged www-data
- migrate/seed explicitly unavailable until M2 (#12); #10 remains open

Verified via clean-start acceptance on remote host (keith@192.168.2.23).

tests/Http/AppTest.php

@@ -0,0 +1,113 @@
+<?php
+
+declare(strict_types=1);
+
+namespace MeshVault\Tests\Http;
+
+use MeshVault\Config\AppConfig;
+use MeshVault\Http\AppFactory;
+use MeshVault\Http\HomeHandler;
+use MeshVault\Http\View;
+use PHPUnit\Framework\TestCase;
+use Slim\Psr7\Factory\ServerRequestFactory;
+use Slim\Psr7\Response;
+
+final class AppTest extends TestCase
+{
+    private function app(string $environment = 'production'): \Slim\App
+    {
+        self::assertTrue(class_exists(AppFactory::class), 'HTTP AppFactory must exist');
+        return AppFactory::create(AppConfig::fromEnvironment([
+            'MESHVAULT_ENV' => $environment,
+            'MESHVAULT_LIBRARY_DIR' => sys_get_temp_dir(),
+            'MESHVAULT_DB_HOST' => 'db',
+            'MESHVAULT_DB_NAME' => 'meshvault',
+            'MESHVAULT_DB_USER' => 'meshvault',
+            'MESHVAULT_DB_PASSWORD' => 'private-secret',
+        ]));
+    }
+
+    public function testHomeUsesContainerResolvedHandlerAndHtmlView(): void
+    {
+        $app = $this->app();
+        self::assertInstanceOf(\DI\Container::class, $app->getContainer());
+        self::assertInstanceOf(HomeHandler::class, $app->getContainer()->get(HomeHandler::class));
+        $app->getContainer()->set(View::class, new View(dirname(__DIR__, 2) . '/templates'));
+        $response = $app->handle((new ServerRequestFactory())->createServerRequest('GET', '/'));
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('text/html; charset=utf-8', $response->getHeaderLine('Content-Type'));
+        self::assertStringContainsString('<h1 class="text-blue-600">MeshVault</h1>', (string) $response->getBody());
+        self::assertSame(HomeHandler::class, array_values($app->getRouteCollector()->getRoutes())[0]->getCallable());
+    }
+
+    public function testViewEscapesDynamicTextAndQuotes(): void
+    {
+        self::assertTrue(class_exists(View::class), 'PHP View must exist');
+        $html = (new View(dirname(__DIR__, 2) . '/templates'))->render('home', ['title' => '<script>"&\'</script>']);
+        self::assertStringContainsString('&lt;script&gt;&quot;&amp;&#039;&lt;/script&gt;', $html);
+        self::assertStringNotContainsString('<script>', $html);
+    }
+
+    public function testViewRejectsTraversalBeforeStartingOutputBuffer(): void
+    {
+        $level = ob_get_level();
+        try {
+            (new View(dirname(__DIR__, 2) . '/templates'))->render('../config/container', []);
+            self::fail('Traversal must be rejected');
+        } catch (\InvalidArgumentException $exception) {
+            self::assertSame('Unknown view.', $exception->getMessage());
+            self::assertSame($level, ob_get_level());
+        }
+    }
+
+    public function testViewRestoresOutputBufferWhenTemplateThrows(): void
+    {
+        $level = ob_get_level();
+        try {
+            (new View(dirname(__DIR__, 2) . '/templates'))->render('home', ['title' => new \stdClass()]);
+            self::fail('Invalid view value must throw');
+        } catch (\TypeError) {
+            self::assertSame($level, ob_get_level());
+        }
+    }
+
+    public function testNotFound(): void
+    {
+        $response = $this->app()->handle((new ServerRequestFactory())->createServerRequest('GET', '/missing'));
+        self::assertSame(404, $response->getStatusCode());
+        self::assertStringContainsString('Not Found', (string) $response->getBody());
+    }
+
+    public function testMethodNotAllowed(): void
+    {
+        $response = $this->app()->handle((new ServerRequestFactory())->createServerRequest('POST', '/'));
+        self::assertSame(405, $response->getStatusCode());
+        self::assertStringContainsString('GET', $response->getHeaderLine('Allow'));
+    }
+
+    public function testProductionExceptionIsGeneric(): void
+    {
+        $app = $this->app();
+        $app->get('/test-only', function (): never {
+            throw new \RuntimeException('private-secret <script>failure</script>');
+        });
+        $response = $app->handle((new ServerRequestFactory())->createServerRequest('GET', '/test-only'));
+        self::assertSame(500, $response->getStatusCode());
+        self::assertStringContainsString('Internal Server Error', (string) $response->getBody());
+        self::assertStringNotContainsString('private-secret', (string) $response->getBody());
+        self::assertStringNotContainsString('AppTest', (string) $response->getBody());
+    }
+
+    public function testDevelopmentExceptionIsReadableAndEscaped(): void
+    {
+        $app = $this->app('development');
+        $app->get('/test-only', function (): never {
+            throw new \RuntimeException('Readable <script>failure</script>');
+        });
+        $response = $app->handle((new ServerRequestFactory())->createServerRequest('GET', '/test-only'));
+        self::assertSame(500, $response->getStatusCode());
+        $body = (string) $response->getBody();
+        self::assertStringContainsString('Readable &lt;script&gt;failure&lt;/script&gt;', $body);
+        self::assertStringNotContainsString('<script>', (string) $response->getBody());
+    }
+}

tests/Http/BootstrapTest.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace MeshVault\Tests\Http;
+
+use PHPUnit\Framework\TestCase;
+
+final class BootstrapTest extends TestCase
+{
+    private function runPhp(string $file, string $mode, bool $valid): array
+    {
+        $env = array_merge(getenv(), [
+            'MESHVAULT_ENV' => $mode,
+            'MESHVAULT_LIBRARY_DIR' => sys_get_temp_dir(),
+            'MESHVAULT_DB_HOST' => $valid ? 'db' : '',
+            'MESHVAULT_DB_NAME' => 'meshvault',
+            'MESHVAULT_DB_USER' => 'meshvault',
+            'MESHVAULT_DB_PASSWORD' => 'bootstrap-secret',
+        ]);
+        $code = 'register_shutdown_function(function () { fwrite(STDERR, "STATUS=" . http_response_code()); });'
+            . 'require ' . var_export($file, true) . ';';
+        $process = proc_open([PHP_BINARY, '-r', $code], [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes, null, $env);
+        $out = stream_get_contents($pipes[1]);
+        $err = stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        return [proc_close($process), $out, $err];
+    }
+
+    public function testProductionBootstrapFailureIsGeneric500(): void
+    {
+        [$exit, $out, $err] = $this->runPhp('public/index.php', 'production', false);
+        self::assertStringContainsString('Internal Server Error', $out);
+        self::assertStringContainsString('STATUS=500', $err);
+        self::assertStringNotContainsString('MESHVAULT_DB_HOST', $out);
+        self::assertStringNotContainsString('bootstrap-secret', $out . $err);
+        self::assertStringContainsString('MESHVAULT_DB_HOST', $err);
+    }
+
+    public function testDevelopmentBootstrapFailureIsReadable(): void
+    {
+        [$exit, $out, $err] = $this->runPhp('public/index.php', 'development', false);
+        self::assertStringContainsString('MESHVAULT_DB_HOST', $out);
+        self::assertStringContainsString('STATUS=500', $err);
+        self::assertStringNotContainsString('bootstrap-secret', $out . $err);
+    }
+
+    public function testConfigCliSucceedsOnlyForValidConfig(): void
+    {
+        self::assertFileExists('bin/check-config.php');
+        [$exit, $out, $err] = $this->runPhp('bin/check-config.php', 'production', true);
+        self::assertSame(0, $exit, $err);
+        [$exit, $out, $err] = $this->runPhp('bin/check-config.php', 'production', false);
+        self::assertSame(1, $exit);
+        self::assertStringContainsString('MESHVAULT_DB_HOST', $err);
+        self::assertStringNotContainsString('bootstrap-secret', $out . $err);
+    }
+}

tests/Http/DeploymentTest.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace MeshVault\Tests\Http;
+
+use PHPUnit\Framework\TestCase;
+
+final class DeploymentTest extends TestCase
+{
+    public function testFpmConfigExistsAndForwardsUndecoratedWorkerLogs(): void
+    {
+        $path = dirname(__DIR__, 2) . '/docker/php/zz-meshvault.conf';
+        self::assertFileExists($path);
+        $config = file_get_contents($path);
+        self::assertStringContainsString('clear_env = no', $config);
+        self::assertStringContainsString('catch_workers_output = yes', $config);
+        self::assertStringContainsString('decorate_workers_output = no', $config);
+    }
+
+    public function testComposeSuppliesEveryApplicationSettingAndViewDirectory(): void
+    {
+        $compose = file_get_contents(dirname(__DIR__, 2) . '/docker-compose.yml');
+        $app = explode('  db:', explode('  app:', $compose, 2)[1], 2)[0];
+        foreach (['ENV', 'LOG_LEVEL', 'DB_HOST', 'DB_PORT', 'DB_NAME', 'DB_USER', 'DB_PASSWORD'] as $key) {
+            self::assertStringContainsString('MESHVAULT_' . $key . ':', $app);
+        }
+        foreach (['config', 'templates'] as $directory) {
+            self::assertStringContainsString('./' . $directory . ':/var/www/html/' . $directory . ':ro', $app);
+        }
+    }
+
+    public function testBuildContextIncludesDependencyAndStartupInputs(): void
+    {
+        $ignore = file_get_contents(dirname(__DIR__, 2) . '/.dockerignore');
+        foreach (['composer.json', 'composer.lock', 'bin/', 'bin/**', 'docker/php/**'] as $input) {
+            self::assertStringContainsString('!' . $input, $ignore);
+        }
+    }
+}