ARCHITECTURE

Next.js App Router + TypeScript + Postgres + Prisma + Tailwind.

• Auth: password + MFA TOTP required; SES password reset (stub driver); invite email; magic-link OK later.
• Session: httpOnly cookie JWT (vdr_session) with MFA gate.
• Scope helper src/lib/scope.ts → assertRoomAccess returns 404 cross-tenant.
• Storage: STORAGE_DRIVER=fs local fallback; S3-ready interface.
• Agent: room-scoped retrieval stub; refuses cross-room; egress off.
• Commercial: Practice N=2 @ plan enum; invoice-first (no Stripe in P0).
• Docker Compose runs app + Postgres.