feat: initial zROC project recreation (stubs for large files pending)

- 61 files across zroc-ui/ and zroc-ova/ directories
- Full content written for: config, auth, API layers, CSS, build files,
  OVA scripts, backend routes, charts, hooks, constants
- Stubs in place for: page components, Sidebar, TopBar, docker-compose,
  authentik client, blueprint YAML, packer HCL, workflows, setup wizard

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

zroc-ui/backend/server.js

@@ -0,0 +1,75 @@
+// backend/server.js — zROC UI backend entry point
+'use strict';
+
+const path    = require('path');
+const express = require('express');
+const session = require('express-session');
+const rateLimit = require('express-rate-limit');
+const cookieParser = require('cookie-parser');
+
+const config  = require('./config');
+const logger  = require('./logger');
+
+const authRoutes      = require('./routes/auth');
+const prometheusRoute = require('./routes/prometheus');
+const adminUserRoutes = require('./routes/admin/users');
+
+const app = express();
+
+app.set('trust proxy', 1);
+
+app.use(express.json());
+app.use(express.urlencoded({ extended: false }));
+app.use(cookieParser());
+
+const sessionMiddleware = session({
+  secret:            config.session_secret,
+  resave:            false,
+  saveUninitialized: false,
+  cookie: {
+    secure:   !config.is_dev,
+    httpOnly: true,
+    sameSite: 'lax',
+    maxAge:   config.session_max_age_ms,
+  },
+});
+app.use(sessionMiddleware);
+
+const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 20,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: 'Too many requests, please try again later' },
+});
+app.use('/api/auth', authLimiter);
+
+app.use('/api/auth',          authRoutes);
+app.use('/api/prometheus',    prometheusRoute);
+app.use('/api/admin/users',   adminUserRoutes);
+
+app.get('/api/health', (req, res) => {
+  res.json({ status: 'ok', ts: new Date().toISOString() });
+});
+
+const distPath = path.join(__dirname, '..', 'dist');
+app.use(express.static(distPath));
+app.get('*', (req, res) => {
+  if (req.path.startsWith('/api/')) {
+    return res.status(404).json({ error: 'Not found' });
+  }
+  res.sendFile(path.join(distPath, 'index.html'));
+});
+
+// eslint-disable-next-line no-unused-vars
+app.use((err, req, res, _next) => {
+  logger.error('Unhandled error:', err);
+  res.status(500).json({ error: 'Internal server error' });
+});
+
+app.listen(config.port, () => {
+  logger.info(`[Server] zROC UI backend listening on port ${config.port}`);
+  logger.info(`[Server] Environment: ${config.node_env}`);
+  logger.info(`[Server] Prometheus: ${config.prometheus_url}`);
+  logger.info(`[Server] Authentik:  ${config.authentik_url}`);
+});