Initial scaffold: Shopify recesso (withdrawal) compliance app

- Remix (TypeScript) + Polaris, official Shopify app template
- Prisma multi-tenant schema (Settings, ExclusionRule, WithdrawalRequest, AuditLog, WebhookEvent) on Postgres
- Mandatory GDPR compliance webhooks (data_request, redact, shop/redact) + HMAC handlers
- API version pinned 2026-04, scopes read_orders/read_products
- Fly deploy config; two-env strategy (custom now, public later)
- Dev setup: shopify.web.toml + Vite allowedHosts for tunnels
- Docs: PLAN.md, ANALISI-REQUISITI-LEGALI.md (Art. 54-bis compliance)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mv83a29B4eFv5ixoj6PoE1

app/fly.toml

@@ -0,0 +1,24 @@
+# Fly.io deployment — CUSTOM distribution environment (clienti LIVE).
+# App name: recesso-custom. The future PUBLIC app is a SEPARATE Fly app
+# (recesso-public) with its own DB — deploys here never touch it (PLAN §0-ter).
+#
+# Secrets are NOT stored here. Set them with `fly secrets set` (never commit):
+#   DATABASE_URL, SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOPIFY_APP_URL
+# (SCOPES can also be set as a secret/env to match shopify.app.toml.)
+
+app = "recesso-custom"
+primary_region = "fra" # Frankfurt (EU data residency)
+
+[build]
+  dockerfile = "Dockerfile"
+
+[http_service]
+  internal_port = 3000
+  force_https = true
+  auto_stop_machines = true
+  auto_start_machines = true
+  min_machines_running = 0
+
+[[vm]]
+  size = "shared-cpu-1x"
+  memory = "512mb"