fix: harden backend runtime artifact hygiene

.gitignore

@@ -58,5 +58,8 @@ pids
 # Diagnostic reports (https://nodejs.org/api/report.html)
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
 
-# SQLite data
-prisma/*.db
+# SQLite runtime data
+/dev.db
+/dev.db-*
+/prisma/*.db
+/prisma/*.db-*

package.json

@@ -18,6 +18,7 @@
     "lint": "npm run lint:check",
     "lint:check": "eslint \"{src,apps,libs,test}/**/*.ts\" --max-warnings=0",
     "lint:fix": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
+    "hygiene:check": "node scripts/repository-hygiene-check.mjs",
     "typecheck:app": "tsc --project tsconfig.typecheck.app.json",
     "typecheck:test": "tsc --project tsconfig.typecheck.test.json",
     "test": "jest",

scripts/repository-hygiene-check.mjs

@@ -0,0 +1,60 @@
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve } from 'node:path';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+
+function git(args) {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
+}
+
+function isIgnored(file) {
+  try {
+    execFileSync('git', ['check-ignore', '--no-index', '-q', file], {
+      cwd: root,
+      stdio: 'ignore',
+    });
+    return true;
+  } catch (error) {
+    if (error.status === 1) return false;
+    throw error;
+  }
+}
+
+function assert(condition, message) {
+  if (!condition) throw new Error(message);
+}
+
+const trackedDatabases = git([
+  'ls-files',
+  '--',
+  'dev.db',
+  'dev.db-*',
+  'prisma/*.db',
+  'prisma/*.db-*',
+])
+  .split('\n')
+  .filter(Boolean);
+
+assert(
+  trackedDatabases.length === 0,
+  `Runtime SQLite files in supported locations must not be tracked; found: ${trackedDatabases.join(', ')}`,
+);
+
+for (const file of [
+  'dev.db',
+  'dev.db-wal',
+  'dev.db-shm',
+  'prisma/dev.db',
+  'prisma/dev.db-wal',
+  'prisma/dev.db-shm',
+]) {
+  assert(isIgnored(file), `Runtime SQLite file must be ignored: ${file}`);
+}
+
+assert(
+  !isIgnored('test/fixtures/reference.db'),
+  'Intentional fixture must remain versionable',
+);
+
+console.log('Backend repository hygiene verified');