Initial commit: TravelHub multi-tenant flight booking platform

Angular + Go + PostgreSQL sample with strict per-tenant isolation.

- Backend: Go API (basic auth, tenant-scoped repository layer, pgx pool)
- Frontend: Angular 22 SPA (search, checkout, bookings, dashboard)
- Database: schema, seed data and demo bookings migrations
- Tests: 311 across Go (integration), Angular (unit) and Playwright (e2e),
  plus a generated evidence report with PDF export
- Security: whitebox VAPT report under security/

Secrets (.env, tokens, DB credentials) are git-ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/.env.example

@@ -0,0 +1,19 @@
+# Copy to .env and fill in real values. .env is git-ignored.
+
+# --- database ---------------------------------------------------------------
+# Either set DATABASE_URL directly, or set the individual DB_* parts below and
+# let the app assemble the URL. DATABASE_URL wins if both are present.
+# DATABASE_URL=postgres://postgres:password@localhost:5432/travelhub?sslmode=disable
+
+DB_HOST=localhost
+DB_PORT=5432
+DB_USER=postgres
+DB_PASSWORD=change-me
+DB_NAME=travelhub
+DB_SSLMODE=disable
+
+# --- server -----------------------------------------------------------------
+PORT=8080
+
+# Comma-separated list of origins allowed to call the API from a browser.
+CORS_ORIGINS=http://localhost:4200