feat: sprint 1 — auth + CRUD engagements

Ship the first feature end-to-end on the UI: users log in with JWT,
admins manage user accounts, and any authenticated user (per RBAC)
can create, list, view, edit, and delete engagements.

Backend (Flask + SQLAlchemy + SQLite, 63 pytest)
- User / Engagement models, Alembic 0001 initial schema
- argon2 password hashing, JWT bearer (60-min TTL), @login_required
  and @role_required decorators
- 13 API endpoints under /api/*, including last-admin protection on
  DELETE/PATCH user and JSON 404 on unknown /api/* paths
- `flask create-admin` CLI with duplicate / short-password handling

Frontend (React + Vite + Tailwind + TanStack Query, 20 vitest)
- Inter font bundled locally (no CDN), DESIGN.md tokens in Tailwind
- LoginPage / EngagementsList / EngagementForm / EngagementDetail /
  UsersAdmin pages with role-aware UI
- Layout, ProtectedRoute, StatusBadge, FormField, LoadingState,
  ErrorState, EmptyState, Toast + provider
- Axios client: Bearer interceptor, 401 → purge + /login + "Session
  expirée" toast, 403 → "Accès refusé" toast (declarative <Navigate>
  for already-authed users, Fragment-keyed admin user rows)

Deployment
- Single multistage Dockerfile (node:20-alpine → python:3.12-slim)
- docker/entrypoint.sh runs `flask db upgrade` before `flask run`
- Makefile: build/start/stop/restart/update/logs/create-admin/
  update-mitre/test-{backend,frontend,e2e}/clean
- .env.example documenting MIMIC_JWT_SECRET / MIMIC_DB_PATH / MIMIC_PORT
- SQLite at /data/mimic.sqlite on named volume mimic-data

Acceptance suite (Playwright, 36 tests, all 27 ACs)
- e2e/ scaffold with playwright.config + auth/api fixtures
- One spec per user story (us1-bootstrap through us6-deployment)
- Portable via MIMIC_CONTAINER_CMD / MIMIC_BASE_URL (docker or podman)

Docs
- README.md with quick-start and architecture overview
- CHANGELOG.md updated with Sprint 1 deliverables
- pyrightconfig.json so the Python LSP sees backend/.venv and
  resolves the `backend.app.*` absolute imports

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

e2e/tests/us6-deployment.spec.ts

@@ -0,0 +1,117 @@
+/**
+ * US-6 — deployment via Makefile + Docker.
+ *
+ * These checks are infrastructure-level: they shell out to `make` and the
+ * container runtime to assert the build/run targets behave correctly and
+ * the SQLite volume survives a restart.
+ *
+ * The container is expected to already be `up` when the suite starts (the
+ * harness runs `make build && make start && make create-admin` before
+ * Playwright). So `AC-6.1`/`AC-6.2` are verified via image presence + HTTP
+ * smoke; `AC-6.3` exercises stop/restart/logs; `AC-6.4` writes a row, restarts,
+ * and re-reads it; `AC-6.5` confirms the test targets exist as Makefile rules.
+ */
+import { test, expect } from '@playwright/test';
+import { execSync } from 'node:child_process';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
+import {
+  adminToken,
+  createEngagement,
+  deleteAllEngagements,
+  listEngagements,
+  waitForHealth,
+} from '../fixtures/api';
+
+const RUNTIME = process.env.MIMIC_CONTAINER_CMD ?? 'docker';
+const CONTAINER = process.env.MIMIC_CONTAINER ?? 'mimic';
+const IMAGE = process.env.MIMIC_IMAGE ?? 'mimic:latest';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, '../..');
+
+function run(cmd: string, opts: { ignoreFail?: boolean } = {}): { status: number; out: string } {
+  try {
+    const out = execSync(cmd, {
+      cwd: REPO_ROOT,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      encoding: 'utf8',
+    });
+    return { status: 0, out };
+  } catch (e) {
+    const err = e as { status?: number; stdout?: Buffer | string; stderr?: Buffer | string };
+    const out =
+      (typeof err.stdout === 'string' ? err.stdout : err.stdout?.toString() ?? '') +
+      (typeof err.stderr === 'string' ? err.stderr : err.stderr?.toString() ?? '');
+    if (opts.ignoreFail) return { status: err.status ?? -1, out };
+    throw new Error(`command failed (${err.status}): ${cmd}\n${out}`);
+  }
+}
+
+test.describe('US-6 — deployment via Docker + Makefile', () => {
+  test('AC-6.1 — image mimic:latest exists (built by make build)', () => {
+    const r = run(`${RUNTIME} images --format "{{.Repository}}:{{.Tag}}"`);
+    expect(r.out).toMatch(new RegExp(IMAGE.replace(/[.:]/g, '\\$&')));
+  });
+
+  test('AC-6.2 — container responds on http://localhost:5000 (front + /api/health)', async () => {
+    await waitForHealth(5_000);
+    // Frontend is served at "/". Use 127.0.0.1 explicitly so envs where
+    // `localhost` resolves to ::1 (where the container port isn't bound)
+    // don't break this contract test.
+    const base = (process.env.MIMIC_BASE_URL ?? 'http://127.0.0.1:5000').replace(/\/$/, '');
+    const html = run(`curl -fsS ${base}/`).out;
+    expect(html).toMatch(/<!doctype html>/i);
+    expect(html.toLowerCase()).toMatch(/mimic/);
+  });
+
+  test('AC-6.3 — make stop / make restart / make logs are well-formed targets', () => {
+    // Don't actually stop the container mid-suite — that would tear down
+    // the other tests. Instead, verify the Makefile rules exist and are
+    // syntactically valid by asking make for their recipes via `--just-print`.
+    // `make restart` expands to `make stop && make start`, so we look for
+    // those sub-commands instead of a literal "restart" token.
+    const dry = run('make --dry-run --no-print-directory stop restart logs');
+    expect(dry.out).toMatch(new RegExp(`${RUNTIME} stop ${CONTAINER}`));
+    expect(dry.out).toMatch(/make stop && make start/);
+    expect(dry.out).toMatch(new RegExp(`${RUNTIME} logs -f ${CONTAINER}`));
+
+    const makefile = readFileSync(resolve(REPO_ROOT, 'Makefile'), 'utf8');
+    expect(makefile).toMatch(/^stop:/m);
+    expect(makefile).toMatch(/^restart:/m);
+    expect(makefile).toMatch(/^logs:/m);
+  });
+
+  test('AC-6.4 — SQLite persists across container restart (named volume mimic-data)', async () => {
+    const token = await adminToken();
+    // Seed a unique engagement.
+    const marker = `AC-6.4-persistence-${Date.now()}`;
+    await createEngagement(token, { name: marker, start_date: '2026-12-01' });
+
+    // Restart the container (NOT make restart, since that would also rm —
+    // we do `runtime restart` which keeps the same container + volume).
+    run(`${RUNTIME} restart ${CONTAINER}`);
+    await waitForHealth(20_000);
+
+    const token2 = await adminToken();
+    const items = await listEngagements(token2);
+    const found = items.find((i) => i.name === marker);
+    expect(found, `engagement seeded before restart should survive`).toBeTruthy();
+
+    // Cleanup.
+    await deleteAllEngagements(token2);
+  });
+
+  test('AC-6.5 — make test-backend / test-frontend / test-e2e are defined', () => {
+    const makefile = readFileSync(resolve(REPO_ROOT, 'Makefile'), 'utf8');
+    expect(makefile).toMatch(/^test-backend:/m);
+    expect(makefile).toMatch(/^test-frontend:/m);
+    expect(makefile).toMatch(/^test-e2e:/m);
+
+    // Dry-run them to make sure the recipes are syntactically valid.
+    const dry = run('make --dry-run --no-print-directory test-backend test-frontend test-e2e');
+    expect(dry.out).toMatch(/pytest/);
+    expect(dry.out).toMatch(/npm run test/);
+    expect(dry.out).toMatch(/playwright test/);
+  });
+});