Phase 1 scaffold: auth for all apps

- Backend: Fastify with two listeners (public + internal), routes, services, DB migration + seed
- client_app: Flutter with BLoC, all auth screens (welcome, display name, register, OTP, force-register)
- mitra_app: Flutter with BLoC, OTP-only login
- control_center: React + Vite, email/password login, mitra/user management, anonymity settings
- Docs: phase1 plan, API contract, client app mockup
- CLAUDE.md and shared memory for all subprojects

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -0,0 +1,49 @@
+# Halo Bestie — Project Root
+
+Mental health chat platform connecting clients (users seeking support) with trained mental health professionals (mitra). Paid service with optional trial period.
+
+## Folder Structure
+
+| Folder | Purpose |
+|---|---|
+| `requirement/` | Requirement documents (phased) |
+| `backend/` | Fastify.js API server |
+| `client_app/` | Flutter app for clients (iOS + Android) |
+| `mitra_app/` | Flutter app for professionals/mitra (iOS + Android) |
+| `control_center/` | React + Vite SPA — internal management tool |
+
+## Tech Stack
+
+- **Backend:** Fastify.js — single codebase, two listeners
+  - Public (port 3000) → serves `client_app` and `mitra_app`
+  - Internal (port 3001) → serves `control_center` only
+- **Database:** PostgreSQL (GCP Cloud SQL)
+- **Auth:** Firebase Auth — Google/Apple social login + phone OTP (native Flutter UI, no WebView)
+- **Payment:** Xendit
+- **Mobile:** Flutter (iOS + Android)
+- **Control Center:** React + Vite SPA
+- **Infra:** GCP — Cloud Run (backend), Cloud SQL (PostgreSQL), VPC private networking
+
+## Key Architectural Decisions
+
+- **One backend** serves both mobile apps — routes namespaced as `/api/client/`, `/api/mitra/`, `/api/shared/`
+- **Control center is internal-only** — never expose its API routes to the public internet; protected via Nginx allow/deny + VPN
+- **Firebase Auth** tokens are verified on Fastify via JWT — user data lives in PostgreSQL, linked by Firebase UID
+- **Horizontal scaling** (Cloud Run) handles load — do not split into microservices prematurely
+- **Real-time features** (chat) are deferred to requirements phase
+
+## Current Progress
+
+- **Phase 1 (Authentication)** — fully scaffolded
+  - Backend routes, services, DB migration + seed script
+  - client_app: all auth screens (welcome, display name, register, OTP, force-register)
+  - mitra_app: OTP-only login
+  - control_center: email/password login, mitra management, user management, anonymity settings
+  - Docs: `requirement/phase1-plan.md`, `requirement/phase1-api-contract.md`, `requirement/client_app_mockup.html`
+- **Phase 2 (Sessions, Chat, Payments)** — not yet started, requirements not yet written
+
+## Domain Concepts
+
+- **Client** — end user seeking mental health support
+- **Mitra** — trained mental health professional (partner)
+- Sessions are paid; Xendit handles payment and subscription/trial logic