feat(tenant): single-tenant mode core (config SSOT + server/UI guards + branding)

Add lib/tenant.ts as the single source of truth for multi- vs single-tenant
deployment. Gate space creation (server + signup UI), add open-join to the one
space, hide the marketing shell, and route brand name + base URL through config.
Also commit the _migrations_applied table into the canonical schema so a fresh
instance is reproducible from schema.sql alone.

- lib/tenant.ts: resolveTenantConfig (pure) + tenantConfig() + appBaseUrl()
- lib/auth-actions.ts: createSpace refused when !allowSpaceCreation; joinSpace
  open-join resolves the configured/sole space with no invite code
- proxy.ts: marketing paths redirect to /login when showMarketing is off
- app/signup/page.tsx: single-tenant hides create/join chooser, brand=siteName
- app/layout.tsx + 4 link builders: brand/base-URL via config (no hackerspace.sh literal)
- scripts/schema.sql: public._migrations_applied tracking table
- .env.example: documented single-tenant + first-admin bootstrap vars
- package.json: pnpm setup

scripts/schema.sql

@@ -2978,3 +2978,17 @@ DROP TRIGGER IF EXISTS trg_dues_payment_methods_touch ON public.dues_payment_met
 CREATE TRIGGER trg_dues_payment_methods_touch
   BEFORE UPDATE ON public.dues_payment_methods
   FOR EACH ROW EXECUTE FUNCTION public.touch_updated_at();
+
+
+-- -----------------------------------------------------------------------------
+-- MIGRATION TRACKING
+-- -----------------------------------------------------------------------------
+-- The deploy script (deploy/deploy.sh) applies each numbered scripts/0NN_*.sql
+-- exactly once and records the filename here. Defined in the canonical schema so
+-- a fresh instance is fully reproducible from this file alone (previously this
+-- table was created ad hoc on the production host and existed nowhere in-repo).
+-- Not a tenant table: it holds no member data and needs no RLS.
+CREATE TABLE IF NOT EXISTS public._migrations_applied (
+  filename    text PRIMARY KEY,
+  applied_at  timestamptz NOT NULL DEFAULT now()
+);