Initial commit: TravelHub multi-tenant flight booking platform

Angular + Go + PostgreSQL sample with strict per-tenant isolation.

- Backend: Go API (basic auth, tenant-scoped repository layer, pgx pool)
- Frontend: Angular 22 SPA (search, checkout, bookings, dashboard)
- Database: schema, seed data and demo bookings migrations
- Tests: 311 across Go (integration), Angular (unit) and Playwright (e2e),
  plus a generated evidence report with PDF export
- Security: whitebox VAPT report under security/

Secrets (.env, tokens, DB credentials) are git-ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

e2e/pages/login.page.ts

@@ -0,0 +1,56 @@
+import { expect, Locator, Page } from '@playwright/test';
+
+import { Account } from '../fixtures/accounts';
+
+/** The sign-in screen: agency picker, credentials, demo shortcuts. */
+export class LoginPage {
+  readonly tenantSelect: Locator;
+  readonly email: Locator;
+  readonly password: Locator;
+  readonly submit: Locator;
+  readonly error: Locator;
+  readonly demoChips: Locator;
+
+  constructor(private readonly page: Page) {
+    this.tenantSelect = page.locator('#tenant');
+    this.email = page.locator('#email');
+    this.password = page.locator('#password');
+    // Matched by role rather than label: the button relabels itself to
+    // "Signing in…" while a request is in flight, and tests assert on that.
+    this.submit = page.locator('form button[type="submit"]');
+    this.error = page.locator('.alert-error');
+    this.demoChips = page.locator('.demo-chip');
+  }
+
+  async goto(): Promise<void> {
+    await this.page.goto('/login');
+    await expect(this.submit).toBeVisible();
+  }
+
+  /** Fills the form from the demo shortcut for the given account. */
+  async useDemoChip(account: Account): Promise<void> {
+    await this.demoChips.filter({ hasText: account.email }).first().click();
+  }
+
+  async fill(account: Account, password = account.password): Promise<void> {
+    await this.tenantSelect.selectOption(account.tenant);
+    await this.email.fill(account.email);
+    await this.password.fill(password);
+  }
+
+  /** Signs in and waits for the console to appear. */
+  async signIn(account: Account): Promise<void> {
+    await this.goto();
+    await this.useDemoChip(account);
+    await this.submit.click();
+    await this.page.waitForURL('**/dashboard');
+  }
+
+  /** Attempts a sign-in that is expected to fail, and returns the message. */
+  async signInExpectingFailure(account: Account, password: string): Promise<string> {
+    await this.fill(account, password);
+    await this.submit.click();
+    await expect(this.error).toBeVisible();
+    return (await this.error.innerText()).trim();
+  }
+}