Initial Camp Scan ticketing system

Backend (Fastify + TS): FluentForms webhook -> NocoDB row + QR + MailerSend
email; PIN auth; scan/lookup/redeem with per-code serialization; reusable QR
codes with count-based check-in; admin search.

App (Expo, one codebase): Android APK + iPhone PWA. Login, camera scanner
(native + web barcode-detector split), green/red overlay with sound + haptics,
admin lookup/redeem. Session token persisted per device.

Ops: multi-stage Dockerfile serving API + PWA same-origin, compose bound to
127.0.0.1; Forgejo Actions runner + tag-triggered signed APK build for Obtainium.
Docs in README.md and INSTALL.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,28 @@
+# Copy to .env and fill in. NEVER commit .env.
+
+# HTTP port the container listens on (nginx proxies scan.beartariacampgrounds.com -> 127.0.0.1:8080)
+PORT=8080
+
+# Existing NocoDB instance
+NOCODB_BASE_URL=https://nocodb.beartariacampgrounds.com
+# API token (xc-token) created in NocoDB: Account Settings -> Tokens
+NOCODB_API_TOKEN=
+# Table ID of "2026 Campground Tickets" (right-click table -> Copy Table ID, looks like m1a2b3c4d5e6f7)
+NOCODB_TABLE_ID=
+
+# MailerSend
+MAILERSEND_API_TOKEN=
+MAIL_FROM_EMAIL=tickets@beartariacampgrounds.com
+MAIL_FROM_NAME=Beartaria Campgrounds
+
+# Shared secret FluentForms sends in the X-Webhook-Secret header (long random string)
+WEBHOOK_SECRET=
+
+# Gate staff PIN for the scanner app
+EVENT_PIN=
+
+# JWT signing secret (long random string) and token lifetime
+TOKEN_SECRET=
+TOKEN_TTL=30d
+
+LOG_LEVEL=info