Separate engineer app

Engineer Portal PWA shell

This app is intentionally separate from the existing admin and resident Engage app. It will run on its own subdomain and only serve engineer workflows.

What this PR sets up

Dedicated engineer-only PWA shell

Separate PM2 process and subdomain-ready start script

No resident/admin routes moved from the existing app

Ready for dedicated engineer auth and permissions in the next PR

Security direction

The QR token remains public and only identifies a block. Future PRs will add dedicated engineer login, engineer session cookies and organisation or block access checks before any private information is fetched.