initial project setup

Fastify + Prisma backend, React + Vite frontend, Docker deployment.
Multi-board feedback platform with anonymous cookie auth, passkey
upgrade path, ALTCHA spam protection, plugin system, and full
privacy-first architecture.

README.md

@@ -0,0 +1,57 @@
+# Echoboard
+
+A self-hosted feedback board where users submit feature requests and bug reports without creating an account. Anonymous by default, with optional passkey registration for persistence across devices.
+
+## Quick start
+
+```bash
+git clone <repo-url>
+cd echoboard
+cp .env.example .env
+
+# Generate secrets
+node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# Paste output into APP_MASTER_KEY, APP_BLIND_INDEX_KEY, TOKEN_SECRET, JWT_SECRET, ALTCHA_HMAC_KEY
+
+# Generate VAPID keys for push notifications
+npx web-push generate-vapid-keys
+# Paste into VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY
+
+# Set WEBAUTHN_RP_ID and WEBAUTHN_ORIGIN to your domain
+
+docker compose up -d
+docker compose exec app npx echoboard create-admin --email you@example.com
+```
+
+## Development
+
+```bash
+npm install
+cp .env.example .env
+# Fill in .env with dev values (WEBAUTHN_RP_ID=localhost, WEBAUTHN_ORIGIN=http://localhost:3000)
+
+npm run dev
+```
+
+This starts the API on port 3000 and the Vite dev server on port 5173 (with API proxy).
+
+## Architecture
+
+- **packages/api** - Fastify + Prisma backend
+- **packages/web** - React + Vite frontend
+- **plugins/** - Optional integrations (Gitea, GitHub, etc.)
+
+## Identity model
+
+Two tiers of user identity:
+
+1. **Anonymous cookie** (default) - zero friction, browser-generated token, single device only
+2. **Passkey** (optional upgrade) - username + WebAuthn biometric, works across devices, no email needed
+
+## Plugin system
+
+Plugins live in `plugins/` and are registered in `echoboard.plugins.ts`. Each plugin is self-contained with its own routes, database tables, and UI components. Removing a plugin leaves zero trace in the core app.
+
+## License
+
+CC0-1.0