Scaffold Pwned Passwords clone: React/wouter frontend, Koa/pg backend, import CLI

- Backend: Koa + @koa/router serving the HIBP-style /range/:prefix k-anonymity
  API, backed by Postgres via pg, with migrate/seed scripts run through tsx.
- Frontend: React + wouter, bundled with webpack (dev server + prod build),
  thin client that hashes passwords locally and only sends the hash prefix.
- Import package: CLI to bulk-load a wordlist or hash list into the database,
  plus a separate script to pull the full dataset from the HIBP range API.
  Both support parallelism (worker threads for wordlist hashing, concurrency
  limiter for DB/HTTP fan-out).
- Dev tooling: docker compose for a local Postgres, .env.local/.env.example,
  DATABASE_URL support as an alternative to discrete PG* vars.

packages/frontend/webpack.config.js

@@ -0,0 +1,47 @@
+const path = require("node:path");
+const HtmlWebpackPlugin = require("html-webpack-plugin");
+
+const backendPort = process.env.BACKEND_PORT || 3001;
+const frontendPort = process.env.FRONTEND_PORT || 3000;
+
+module.exports = (_env, argv) => {
+  const isDev = argv.mode !== "production";
+
+  return {
+    entry: "./src/index.tsx",
+    devtool: isDev ? "eval-source-map" : "source-map",
+    output: {
+      path: path.resolve(__dirname, "dist"),
+      filename: "bundle.[contenthash].js",
+      clean: true,
+    },
+    resolve: {
+      extensions: [".tsx", ".ts", ".js"],
+    },
+    module: {
+      rules: [
+        {
+          test: /\.tsx?$/,
+          use: "ts-loader",
+          exclude: /node_modules/,
+        },
+      ],
+    },
+    plugins: [
+      new HtmlWebpackPlugin({
+        template: "./public/index.html",
+      }),
+    ],
+    devServer: {
+      port: frontendPort,
+      historyApiFallback: true,
+      hot: true,
+      proxy: [
+        {
+          context: ["/range"],
+          target: `http://localhost:${backendPort}`,
+        },
+      ],
+    },
+  };
+};