Scaffold Pwned Passwords clone: React/wouter frontend, Koa/pg backend, import CLI

- Backend: Koa + @koa/router serving the HIBP-style /range/:prefix k-anonymity
  API, backed by Postgres via pg, with migrate/seed scripts run through tsx.
- Frontend: React + wouter, bundled with webpack (dev server + prod build),
  thin client that hashes passwords locally and only sends the hash prefix.
- Import package: CLI to bulk-load a wordlist or hash list into the database,
  plus a separate script to pull the full dataset from the HIBP range API.
  Both support parallelism (worker threads for wordlist hashing, concurrency
  limiter for DB/HTTP fan-out).
- Dev tooling: docker compose for a local Postgres, .env.local/.env.example,
  DATABASE_URL support as an alternative to discrete PG* vars.

packages/import/src/hashWorker.ts

@@ -0,0 +1,15 @@
+import { parentPort } from "node:worker_threads";
+import { createHash } from "node:crypto";
+import type { Entry } from "./upsertBatch.ts";
+
+function sha1(value: string): string {
+  return createHash("sha1").update(value).digest("hex").toUpperCase();
+}
+
+parentPort?.on("message", (lines: string[]) => {
+  const entries: Entry[] = lines.map((line) => {
+    const hash = sha1(line);
+    return { prefix: hash.slice(0, 5), suffix: hash.slice(5), count: 1 };
+  });
+  parentPort!.postMessage(entries);
+});