Initial implementation: multi-tenant Kanban board (Phase 1)

Complete Phase 1 foundation with working board, column, and card CRUD:
- SvelteKit + TypeScript + Tailwind CSS v4 + adapter-node
- Full Prisma schema with 18 tables (tenants, users, boards, columns, cards, etc.)
- Multi-tenant architecture with hostname-based tenant resolution
- Email/password auth with bcrypt + session cookies
- Board/Column/Card API routes with full CRUD
- Fractional indexing for drag-and-drop ordering
- Board view with svelte-dnd-action for column and card drag-and-drop
- Card modal with inline editing
- Auth pages (login, register)
- Board listing with create form
- RLS policies SQL script for tenant isolation
- Prisma RLS client extensions (forTenant/bypassRLS)
- Permission helpers (canEditBoard, canManageMembers, etc.)
- Socket.IO server setup (dev Vite plugin + production Express server)
- Client-side socket store for real-time updates
- Docker Compose (app + PostgreSQL 16) + multi-stage Dockerfile
- Database seed script (default tenant + admin user)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/routes/api/boards/[boardId]/+server.ts

@@ -0,0 +1,102 @@
+import { json, error } from '@sveltejs/kit';
+import type { RequestHandler } from './$types.js';
+import { prisma } from '$lib/server/db.js';
+import { boardSchema } from '$lib/server/validation.js';
+
+// Get single board with all columns and cards
+export const GET: RequestHandler = async ({ params, locals }) => {
+	const tenant = locals.tenant;
+	if (!tenant) throw error(400, 'Unknown tenant');
+
+	const board = await prisma.board.findFirst({
+		where: { id: params.boardId, tenantId: tenant.id },
+		include: {
+			columns: {
+				orderBy: { position: 'asc' },
+				include: {
+					cards: {
+						where: { archived: false },
+						orderBy: { position: 'asc' },
+						include: {
+							assignees: {
+								include: { user: { select: { id: true, name: true, avatarUrl: true } } }
+							},
+							labels: { include: { tag: true } },
+							_count: { select: { comments: true, checklists: true, attachments: true } }
+						}
+					}
+				}
+			},
+			members: {
+				include: { user: { select: { id: true, name: true, email: true, avatarUrl: true } } }
+			}
+		}
+	});
+
+	if (!board) throw error(404, 'Board not found');
+
+	// Check access
+	if (board.visibility === 'PRIVATE') {
+		if (!locals.user) throw error(401, 'Not authenticated');
+		const isMember = board.members.some((m) => m.userId === locals.user!.id);
+		const isAdmin =
+			locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
+		if (!isMember && !isAdmin) throw error(403, 'Access denied');
+	}
+
+	return json({ board });
+};
+
+// Update board
+export const PATCH: RequestHandler = async ({ params, request, locals }) => {
+	const tenant = locals.tenant;
+	if (!tenant) throw error(400, 'Unknown tenant');
+	if (!locals.user) throw error(401, 'Not authenticated');
+
+	const board = await prisma.board.findFirst({
+		where: { id: params.boardId, tenantId: tenant.id },
+		include: { members: true }
+	});
+	if (!board) throw error(404, 'Board not found');
+
+	const member = board.members.find((m) => m.userId === locals.user!.id);
+	const isAdmin =
+		locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
+	if (!member && !isAdmin) throw error(403, 'Access denied');
+	if (member && member.role === 'VIEWER') throw error(403, 'Viewers cannot edit boards');
+
+	const body = await request.json();
+	const result = boardSchema.partial().safeParse(body);
+	if (!result.success) {
+		return json({ error: result.error.issues[0].message }, { status: 400 });
+	}
+
+	const updated = await prisma.board.update({
+		where: { id: params.boardId },
+		data: result.data
+	});
+
+	return json({ board: updated });
+};
+
+// Delete board
+export const DELETE: RequestHandler = async ({ params, locals }) => {
+	const tenant = locals.tenant;
+	if (!tenant) throw error(400, 'Unknown tenant');
+	if (!locals.user) throw error(401, 'Not authenticated');
+
+	const board = await prisma.board.findFirst({
+		where: { id: params.boardId, tenantId: tenant.id },
+		include: { members: true }
+	});
+	if (!board) throw error(404, 'Board not found');
+
+	const member = board.members.find((m) => m.userId === locals.user!.id);
+	const isAdmin =
+		locals.user.globalRole === 'SITE_ADMIN' || locals.user.tenantRole === 'ADMIN';
+	if (member?.role !== 'OWNER' && !isAdmin) throw error(403, 'Only owners can delete boards');
+
+	await prisma.board.delete({ where: { id: params.boardId } });
+
+	return json({ ok: true });
+};