feat: Migrate to ultrathin monolith architecture

Consolidate 3 separate applications (reports-app, data-entry-app, telegram-bot) into a unified
architecture with single backend and frontend:

Backend Changes:
- Unified FastAPI backend at backend/ with modular structure
- Modules: reports, data_entry, telegram in backend/modules/
- Centralized config.py and main.py with all routers registered
- Single worker mode (--workers 1) for Telegram bot compatibility
- Shared Oracle connection pool and JWT authentication
- Unified requirements.txt and environment configuration

Frontend Changes:
- Single Vue.js SPA with module-based routing
- Unified frontend at src/ with modules in src/modules/{reports,data-entry}/
- Shared components and stores in src/shared/
- Error boundaries for module isolation
- Dual API proxy in Vite for module communication

Infrastructure:
- New unified startup scripts: start-prod.sh, start-test.sh, start-backend.sh
- Environment templates: .env.dev.example, .env.test.example, .env.prod.example
- Updated deployment scripts for Windows IIS
- Simplified SSH tunnel management

Documentation:
- Comprehensive CLAUDE.md with architecture overview
- Module-specific docs in docs/{data-entry,telegram}/
- Architecture decision records in docs/ARCHITECTURE-DECISIONS.md
- Deployment guides consolidated in deployment/windows/docs/

This migration reduces complexity, improves maintainability, and enables easier
deployment while maintaining all existing functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

.gitignore

@@ -249,17 +249,17 @@ quick_test.*
 .dockerignore
 .eggs/
 .eggs/
-.env
+# Environment files - ignore ALL .env files (security best practice)
 .env
 .env.*
 .env.*.local
 .env.local
-.env.production
-.env.production
-.env.test
-# Allow .env.example files (configuration templates)
+
+# Allow only .env.example templates (no credentials)
 !.env.example
 !**/.env.example
+!.env.*.example
+!**/.env.*.example
 # Allow .dockerignore files (Docker build configuration)
 !.dockerignore
 !**/.dockerignore
@@ -428,9 +428,6 @@ playwright-report/
 profile_default/
 quick_test.*
 quick_test.*
-# Removed duplicate - already covered in deployment section above
-roa2web/reports-app/telegram-bot/data/*.db
-roa2web/reports-app/telegram-bot/data/*.db-*
 run_tests.*
 run_tests.*
 scan_*.json
@@ -512,6 +509,16 @@ secrets-backup/**/.env.*
 !secrets-backup/**/*.gpg
 
 .playwright-mcp/*
-data-entry-app/backend/data/*
 # Auto-Build local data (worktrees, cache)
 .auto-build-data/
+
+# ============================================================================
+# 🏗️ ULTRATHIN MONOLITH BACKEND DATA - DO NOT COMMIT
+# ============================================================================
+# Backend unified data directories (cache, receipts, telegram)
+backend/data/cache/*.db
+backend/data/receipts/*.db
+backend/data/telegram/*.db
+backend/data/receipts/uploads/*
+!backend/data/*/.gitkeep
+