feat: add SST Ion v3 deployment configuration

[alexespejo]

Summary

• sst.config.ts — SST Ion v3 config that declares all required secrets, provisions an Express-on-Lambda API (sst.aws.Function with Function URL), and a Vite/React static site (sst.aws.StaticSite). VITE_BACKEND_HOSTNAME is auto-wired to the Lambda URL at deploy time.
• server/src/lambda.ts — new Lambda entry point wrapping the existing Express app via serverless-http. Local dev is unaffected (still runs via server.ts).
• server/config/firebase.ts — rewritten to load the Firebase Admin SDK from a FIREBASE_ADMIN_SDK env var (JSON string) in production, falling back to the local firebase-adminsdk.json file for dev. The old static JSON import would crash Lambda bundling since the file is gitignored.
• server/db/db-pgp.ts — fixed PROB_DB_PORT typo → PROD_DB_PORT.
• server/package.json — added serverless-http ^3.
• package.json — added sst ^3 dev dependency.
• .gitignore — added .sst/ (SST platform artifacts).

Secrets required before deploying

Set each via npx sst secret set <Name> <value> [--stage <stage>]:

Secret	Source
FirebaseApiKey … FirebaseMeasurementId (7 vars)	Firebase Console → Project settings → Web app
FirebaseAdminSdk	$(cat server/config/firebase-adminsdk.json)
DbHostname, DbUsername, DbPassword, DbName, DbPort	Your PostgreSQL host
ProdClientHostname	CloudFront URL from first deploy output

First-time deploy sequence

npx sst@3 install                          # install platform types
# set all secrets above (except ProdClientHostname)
npx sst deploy --stage production          # initial deploy
npx sst secret set ProdClientHostname https://xxxx.cloudfront.net --stage production
npx sst deploy --stage production          # update CORS + rebuild client

Notes for reviewers

• The config is intentionally flexible: additional secrets (Stripe, SendGrid, etc.) follow the same new sst.Secret(...) + .value in environment pattern documented in the config comments.
• ProdClientHostname must be set in a second deploy pass to avoid a circular dependency between the Lambda CORS config and the CloudFront URL.
• Non-production stages use removal: "remove" so ephemeral resources are cleaned up automatically.

Test plan

• Confirm yarn install succeeds with serverless-http added
• Confirm local dev (yarn dev) still works — server still starts via server.ts
• Confirm npx sst@3 install runs without errors
• After setting secrets, confirm npx sst deploy --stage <dev-stage> completes and returns ClientUrl / ApiUrl outputs
• Verify the deployed static site loads and can reach the API

🤖 Generated with Claude Code