Scaffold Pwned Passwords clone: React/wouter frontend, Koa/pg backend, import CLI

- Backend: Koa + @koa/router serving the HIBP-style /range/:prefix k-anonymity
  API, backed by Postgres via pg, with migrate/seed scripts run through tsx.
- Frontend: React + wouter, bundled with webpack (dev server + prod build),
  thin client that hashes passwords locally and only sends the hash prefix.
- Import package: CLI to bulk-load a wordlist or hash list into the database,
  plus a separate script to pull the full dataset from the HIBP range API.
  Both support parallelism (worker threads for wordlist hashing, concurrency
  limiter for DB/HTTP fan-out).
- Dev tooling: docker compose for a local Postgres, .env.local/.env.example,
  DATABASE_URL support as an alternative to discrete PG* vars.

packages/backend/src/index.ts

@@ -0,0 +1,23 @@
+import Koa from "koa";
+import { rangeRouter } from "./routes/range.ts";
+
+const app = new Koa();
+
+app.use(async (ctx, next) => {
+  try {
+    await next();
+  } catch (err) {
+    ctx.status = 500;
+    ctx.body = { error: "internal server error" };
+    console.error(err);
+  }
+});
+
+app.use(rangeRouter.routes());
+app.use(rangeRouter.allowedMethods());
+
+const port = process.env.BACKEND_PORT ? Number(process.env.BACKEND_PORT) : 3001;
+
+app.listen(port, () => {
+  console.log(`backend listening on http://localhost:${port}`);
+});