server: zone-labels API (Fastify + SQLite) — Phase A

New server/ service classifying zones as free_2h/3h/4h street vs pay_immediate
lots. Public reads; writes require the admin bearer token (timing-safe compare).
@fastify/rate-limit (120/min global, 20/min writes), manual IP denylist +
auto-block on repeated auth failures. SQLite via better-sqlite3. Dockerfile +
compose (loopback-only, mem/cpu capped) + nginx block + README. 9 tests pass.

Deployed live at https://bigbrainparking.mowden.top (behind nginx + certbot).
Not an npm workspace — kept out of the app/CI install to avoid the native dep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/docker-compose.yml

@@ -0,0 +1,23 @@
+services:
+  bbp-labels:
+    build: .
+    image: bbp-labels:latest
+    container_name: bbp-labels
+    restart: unless-stopped
+    env_file: .env
+    environment:
+      - BBP_DB_PATH=/data/labels.db
+      - PORT=8090
+      - HOST=0.0.0.0
+    # Bound to loopback only — nginx terminates TLS and reverse-proxies to it.
+    # Host port 8097 (8090 is used by another container); container stays 8090.
+    ports:
+      - "127.0.0.1:8097:8090"
+    volumes:
+      - bbp-labels-data:/data
+    # Shared host — keep this service small.
+    mem_limit: 256m
+    cpus: 0.5
+
+volumes:
+  bbp-labels-data: