Backend, marketing site, and app — one deploy

NestJS serves /api/*, static pages at the site root, and the React SPA under /app. Supabase auth with Google and Facebook SSO.