feat: add Django backend skeleton

docs/architecture.md

@@ -25,6 +25,8 @@ The frontend must not calculate authoritative availability. It may display avail
 
 The backend is a Django 5.2 LTS application using Django REST Framework.
 
+The initial backend skeleton lives under `backend/` and includes the Django project, Django admin, the `shows`, `bookings`, and `checkins` apps, CORS configuration for the Angular frontend, PostgreSQL configuration through environment variables, and a health endpoint at `/api/health/`.
+
 Responsibilities:
 
 - expose public read APIs for shows, venues, and performances;

docs/deployment.md

@@ -55,7 +55,7 @@ Responsibilities:
 
 The backend should run database migrations before or during deployment through an explicit operational command, not as hidden startup magic unless that choice is documented later.
 
-At the infrastructure placeholder stage, the `backend` service runs gunicorn against a minimal placeholder WSGI application. The real Django application will replace it later.
+The `backend` service runs gunicorn against the Django WSGI application. The current backend is an initial skeleton with Django admin, Django REST Framework, CORS configuration, the `shows`, `bookings`, and `checkins` apps, and a health endpoint.
 
 ### postgres
 
@@ -97,6 +97,8 @@ Required backend configuration:
 - `DJANGO_SECRET_KEY`;
 - `DJANGO_ALLOWED_HOSTS`;
 - `DJANGO_CSRF_TRUSTED_ORIGINS`;
+- `CORS_ALLOWED_ORIGINS`;
+- `TIME_ZONE`;
 - `DATABASE_URL` or equivalent database settings;
 - email host, port, username, password, TLS settings, and sender address;
 - public site URL used to build confirmation and QR verification links.
@@ -147,14 +149,16 @@ Expected validation commands:
 
 ```bash
 docker compose --env-file .env.example -f infra/docker/compose.yml config
+docker compose --env-file .env.example -f infra/docker/compose.yml run --rm --build backend python manage.py test
 docker compose --env-file .env -f infra/docker/compose.yml run --rm backend python manage.py check --deploy
 docker compose --env-file .env -f infra/docker/compose.yml run --rm backend python manage.py test
 ```
 
-The canonical repository check for the current infrastructure stage is:
+The canonical repository check for the current stage is:
 
 ```bash
 docker compose --env-file .env.example -f infra/docker/compose.yml config
+docker compose --env-file .env.example -f infra/docker/compose.yml run --rm --build backend python manage.py test
 ```
 
 ## Rollback

docs/security-notes.md

@@ -80,6 +80,7 @@ Required controls:
 - check-in verification preview and confirmation require authenticated staff or admin users;
 - staff permissions should separate content management from operational check-in when practical;
 - public APIs must not allow clients to set protected fields such as reservation status, token values, or check-in state.
+- CORS must allow only configured Angular frontend origins through `CORS_ALLOWED_ORIGINS`.
 
 ## Input Validation
 

docs/testing.md

@@ -8,6 +8,7 @@ All tests should run inside Docker containers.
 
 ```bash
 docker compose --env-file .env.example -f infra/docker/compose.yml config
+docker compose --env-file .env.example -f infra/docker/compose.yml run --rm --build backend python manage.py test
 ```
 
 ## Test categories
@@ -21,3 +22,8 @@ Describe applicable categories:
 - Ansible syntax checks;
 - Docker/Compose validation;
 - smoke tests.
+
+## Current coverage
+
+- Docker Compose configuration validation;
+- Django backend unit tests, including the initial health endpoint test.