Initial commit: TravelHub multi-tenant flight booking platform

Angular + Go + PostgreSQL sample with strict per-tenant isolation.

- Backend: Go API (basic auth, tenant-scoped repository layer, pgx pool)
- Frontend: Angular 22 SPA (search, checkout, bookings, dashboard)
- Database: schema, seed data and demo bookings migrations
- Tests: 311 across Go (integration), Angular (unit) and Playwright (e2e),
  plus a generated evidence report with PDF export
- Security: whitebox VAPT report under security/

Secrets (.env, tokens, DB credentials) are git-ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/internal/handlers/session.go

@@ -0,0 +1,44 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/travelswitch/travelhub/backend/internal/models"
+)
+
+// ListTenants backs the agency picker on the sign-in screen. It is
+// unauthenticated by necessity -- the client must choose a tenant before it
+// can present credentials -- so it returns nothing but slugs and display
+// names.
+func (h *Handler) ListTenants(w http.ResponseWriter, r *http.Request) {
+	tenants, err := h.Repo.ListTenants(r.Context())
+	if err != nil {
+		h.fail(w, err, "list tenants")
+		return
+	}
+
+	type publicTenant struct {
+		Slug string `json:"slug"`
+		Name string `json:"name"`
+	}
+	items := make([]publicTenant, 0, len(tenants))
+	for _, t := range tenants {
+		items = append(items, publicTenant{Slug: t.Slug, Name: t.Name})
+	}
+	writeJSON(w, http.StatusOK, items)
+}
+
+// Session echoes the authenticated caller back to the client. The Angular app
+// calls it once at sign-in to validate the credentials it just collected, and
+// again on reload to confirm the stored ones still work.
+func (h *Handler) Session(w http.ResponseWriter, r *http.Request) {
+	id, ok := h.identity(w, r)
+	if !ok {
+		return
+	}
+
+	writeJSON(w, http.StatusOK, struct {
+		User   models.User   `json:"user"`
+		Tenant models.Tenant `json:"tenant"`
+	}{User: id.User, Tenant: id.Tenant})
+}