Initial commit: TravelHub multi-tenant flight booking platform

Angular + Go + PostgreSQL sample with strict per-tenant isolation.

- Backend: Go API (basic auth, tenant-scoped repository layer, pgx pool)
- Frontend: Angular 22 SPA (search, checkout, bookings, dashboard)
- Database: schema, seed data and demo bookings migrations
- Tests: 311 across Go (integration), Angular (unit) and Playwright (e2e),
  plus a generated evidence report with PDF export
- Security: whitebox VAPT report under security/

Secrets (.env, tokens, DB credentials) are git-ignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/open-report.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+/**
+ * Opens a generated report in the default browser.
+ *
+ *   node scripts/open-report.mjs            the evidence report
+ *   node scripts/open-report.mjs playwright Playwright's own HTML report
+ */
+
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+const which = process.argv[2] ?? 'evidence';
+const target =
+  which === 'playwright'
+    ? join(ROOT, 'e2e', 'playwright-report', 'index.html')
+    : join(ROOT, 'e2e', 'evidence-report', 'index.html');
+
+if (!existsSync(target)) {
+  console.error(`No report at ${target}\nRun the suite first: npm run test:e2e`);
+  process.exit(1);
+}
+
+// Each platform has its own opener; none of them need a dependency.
+const [command, args] =
+  process.platform === 'win32'
+    ? ['cmd', ['/c', 'start', '', target]]
+    : process.platform === 'darwin'
+      ? ['open', [target]]
+      : ['xdg-open', [target]];
+
+spawn(command, args, { detached: true, stdio: 'ignore' }).unref();
+console.log(`Opened ${target}`);