Scaffold HIPCTF platform (NestJS + Angular)

- Backend: NestJS 10 + TypeORM (better-sqlite3) feature-modular layout.
  - Entities: user, setting, category, challenge, challenge_file, solve,
    refresh_token, blog_post. Auto-run migrations + idempotent 6-system-
    category seed on startup.
  - Argon2id password hashing with policy check; JWT access + rotating
    refresh tokens (HttpOnly cookie); CSRF middleware (SameSite + custom
    X-CSRF-Token header); global JWT auth guard with @Public() opt-out;
    per-IP login backoff + per-IP registration rate limit.
  - Endpoints: auth (login/refresh/logout/csrf), users (first-admin
    registration), system (bootstrap/event status/SSE), admin (guarded
    user CRUD with last-admin invariant), frontend module (uploads +
    SPA fallback).
  - Security: helmet+CSP+HSTS-gated-by-TLS, CORS allowlist, structured
    global exception filter, Zod request validation pipes, OpenAPI 3.1
    served at /api/docs and /api/docs-json, 10 canonical themes under
    backend/themes/.
- Frontend: Angular 17 standalone components, lazy-loaded feature routes,
  signals, functional HttpInterceptorFn (csrf + auth), functional
  CanActivateFn auth guard, HttpOnly-cookie-based auth service.
- Tests: Jest + supertest, 46 tests across 13 suites covering
  migrations, env schema, theme loader, event status, login backoff,
  registration rate limit, ApiError shape, bootstrap integration,
  auth refresh rotation, admin guard, last-admin invariant, SSE flat
  payloads. Single-command runner: `npm test`.

backend/src/database/database.module.ts

@@ -0,0 +1,68 @@
+import { Module, Global, OnModuleInit, Logger } from '@nestjs/common';
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import * as fs from 'fs';
+import * as path from 'path';
+import { UserEntity } from './entities/user.entity';
+import { SettingEntity } from './entities/setting.entity';
+import { CategoryEntity } from './entities/category.entity';
+import { ChallengeEntity } from './entities/challenge.entity';
+import { ChallengeFileEntity } from './entities/challenge-file.entity';
+import { SolveEntity } from './entities/solve.entity';
+import { RefreshTokenEntity } from './entities/refresh-token.entity';
+import { BlogPostEntity } from './entities/blog-post.entity';
+import { InitSchema1700000000000 } from './migrations/1700000000000-InitSchema';
+import { SeedSystemData1700000000100 } from './migrations/1700000000100-SeedSystemData';
+
+const ENTITIES = [
+  UserEntity,
+  SettingEntity,
+  CategoryEntity,
+  ChallengeEntity,
+  ChallengeFileEntity,
+  SolveEntity,
+  RefreshTokenEntity,
+  BlogPostEntity,
+];
+
+const MIGRATIONS = [InitSchema1700000000000, SeedSystemData1700000000100];
+
+@Global()
+@Module({
+  imports: [
+    TypeOrmModule.forRootAsync({
+      imports: [ConfigModule],
+      inject: [ConfigService],
+      useFactory: (config: ConfigService) => {
+        const dbPath = config.get<string>('DATABASE_PATH', '/data/hipctf/db.sqlite');
+        const isMemory = dbPath === ':memory:' || dbPath.startsWith('file:');
+        if (!isMemory) {
+          const dir = path.dirname(dbPath);
+          if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+        }
+        return {
+          type: 'better-sqlite3',
+          database: dbPath,
+          entities: ENTITIES,
+          migrations: MIGRATIONS,
+          migrationsRun: true,
+          synchronize: false,
+          logging: false,
+        };
+      },
+    }),
+    TypeOrmModule.forFeature(ENTITIES),
+  ],
+  exports: [TypeOrmModule],
+})
+export class DatabaseModule implements OnModuleInit {
+  private readonly logger = new Logger(DatabaseModule.name);
+
+  constructor(private readonly config: ConfigService) {}
+
+  onModuleInit(): void {
+    const dbPath = this.config.get<string>('DATABASE_PATH', '/data/hipctf/db.sqlite');
+    if (dbPath === ':memory:' || dbPath.startsWith('file:')) return;
+    this.logger.log(`Database ready at ${dbPath}`);
+  }
+}