feat(mvp): phase 2 - database schema & services layer

Define full Prisma schema (10 models), run initial migration, build core
services (auth, user, group, app, board, permission), Zod validators,
type definitions, API response envelope, constants, and seed script.

plans/mvp-web-app-launcher/CONTEXT.md

@@ -1,12 +1,17 @@
 # Feature Context: Web App Launcher — MVP
 
 ## Current State
-Phase 1 (Project Scaffolding & Tooling) is complete. The SvelteKit project is initialized with all dependencies installed (`npm install` succeeds). Config files in place: `svelte.config.js` (adapter-node), `vite.config.ts` (Tailwind v4 + Vitest), `tsconfig.json` (strict), `eslint.config.js`, `.prettierrc`, `components.json` (shadcn-svelte), `prisma/schema.prisma` (SQLite). Docker and CI configs created. Build does not pass yet (Big Bang strategy — expected).
+
+Phase 2 (Database Schema & Services Layer) is complete. The Prisma schema defines 10 models (User, Group, UserGroup, App, AppStatus, Board, Section, Widget, Permission, SystemSettings). Initial migration has been applied and the SQLite database created at `data/launcher.db`. Seed data includes an admin user, default groups, 5 sample apps, and a default board with 2 sections. Six server-side services provide full CRUD operations. Zod validators, TypeScript type definitions, shared constants, and an API response envelope utility are all in place. Build does not pass yet (Big Bang strategy — expected).
 
 ## Temporary Workarounds
-- None yet
+
+- Permission model uses polymorphic pattern (entityType/targetType strings) without FK relations to avoid SQLite dual-FK constraint issues. Queries are done manually in `permissionService.ts`.
+- JSON fields (backgroundConfig, config, healthcheckDefaults) are stored as String in SQLite and parsed at the application layer.
+- `package.json` `prisma.seed` config triggers a deprecation warning — migrate to `prisma.config.ts` when upgrading to Prisma 7.
 
 ## Cross-Phase Dependencies
+
 - Phase 2 depends on Phase 1 (project scaffolding, Prisma setup)
 - Phase 3 depends on Phase 2 (user/group models, auth service)
 - Phase 4 depends on Phase 2 (app model, services layer)
@@ -16,8 +21,13 @@ Phase 1 (Project Scaffolding & Tooling) is complete. The SvelteKit project is in
 - Phase 8 depends on all prior phases
 
 ## Implementation Notes
+
 - Big Bang strategy: intermediate phases may not build/pass tests. Only Phase 8 must result in a fully working build.
 - SQLite with Prisma — single file DB at `data/launcher.db`
 - All env config via environment variables; `.env.example` provided as template
 - Svelte 5 runes mode: use `$state`, `$derived`, `$effect` — NOT legacy stores for component state
 - shadcn-svelte uses Bits UI primitives — each component is a local file, not a library import
+- `App.Locals` uses `email` + `displayName` fields (aligned with User model, updated in Phase 2)
+- Prisma client singleton at `src/lib/server/prisma.ts` — use this for all DB access
+- Services export pure async functions (not classes), use immutable patterns
+- `tsx` devDependency added for running the seed script