Initial build: Horizon 1 Prevention Suite + Horizon 2 Unlock demo

Svelte 5 + Vite PWA, styled to match moslem03.falahos.my's design system.

Horizon 1: Faraid Calculator (shared calc core, 14 classical cases passing),
Asset Registry, Wassiyah Generator (1/3 meter + heir-exclusion block),
Hibah Tracker and Family Waqf Designator (shared marad al-mawt guardrail).

Horizon 2: Digital Beneficial Claims — local non-custodial demo of the claim
model and transfer restriction only.

Two governance gates in this project's own PRDs were overridden per explicit
product direction, and are flagged in-app and in README.md / deploy/DEPLOY.md
rather than silently shipped as production-ready:
- Family Waqf Designator ships ahead of scholarly sign-off (OPEN-01 in
  scholarly-review-log.md remains unresolved).
- Horizon 2 ships ahead of the PRD's stated Phase 0 gate (legal opinion +
  signed institutional partner) with no confirmation that gate is cleared.

deploy/docker-stack.yml

@@ -0,0 +1,28 @@
+# Docker Swarm stack for moslem04.falahos.my
+# Matches the deploy pattern used for moslem03 (Docker Swarm, nginx:alpine,
+# Traefik + Let's Encrypt on the Contabo VPS) per UAT-REPORT-moslem03.md in
+# the hermes-macbookair/nur-falah repo.
+#
+# Deploy: docker stack deploy -c deploy/docker-stack.yml nur-falah-prevention
+
+version: '3.8'
+
+services:
+  web:
+    image: git.falahos.my/wmj/nur-falah-prevention:latest
+    networks:
+      - traefik-public
+    deploy:
+      replicas: 1
+      update_config:
+        order: start-first
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.moslem04.rule=Host(`moslem04.falahos.my`)
+        - traefik.http.routers.moslem04.entrypoints=websecure
+        - traefik.http.routers.moslem04.tls.certresolver=letsencrypt
+        - traefik.http.services.moslem04.loadbalancer.server.port=80
+
+networks:
+  traefik-public:
+    external: true