feat: spin 백엔드 전체 구현 (근무·프로젝트·인센티브·회계)

- config/db/storage/auth/router/perms: eQMS 규약 미러링, 권한 2-tier
  (관리자 전체 / 구성원 본인·신청만), oauth2-proxy 헤더 인증 + DEV_AUTH mock
- 모델: 구성원/부서, 근무(출퇴근·휴가·공가·초과), 프로젝트(회사/제품/버전·
  작업자portion·담당자·태스크·계약·첨부·분할입금), 인센티브(설정·단계·
  유저배분·분기정산), 회계(거래·세금)
- internal/worktime: 근로기준법 월 집계 엔진
- internal/incentive: BE/non-BE × 계약금/중도금/잔금 3단계 계산 + 시뮬레이션
- 시드 데이터, Go 멀티스테이지 Dockerfile
- ADMIN_GROUPS 기본값 'admin' (전 내부 앱 공통 그룹)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/db/db.go

@@ -0,0 +1,49 @@
+package db
+
+import (
+	"log"
+	"time"
+
+	"spin/internal/models"
+
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+// Connect opens a GORM connection, retrying a few times to tolerate
+// docker-compose startup ordering, then runs AutoMigrate over models.All().
+func Connect(dsn string) (*gorm.DB, error) {
+	var gdb *gorm.DB
+	var err error
+	for i := 0; i < 15; i++ {
+		gdb, err = gorm.Open(postgres.Open(dsn), &gorm.Config{
+			Logger: logger.Default.LogMode(logger.Warn),
+			// Skip relationship handling during migration to avoid GORM v1.25
+			// ReorderModels panics; runtime associations (Preload/Append) are
+			// unaffected. spin uses explicit join models (e.g. ProjectMember)
+			// rather than many2many, so no manual join table is required.
+			IgnoreRelationshipsWhenMigrating: true,
+		})
+		if err == nil {
+			var sqlDB, e = gdb.DB()
+			if e == nil {
+				if e = sqlDB.Ping(); e == nil {
+					break
+				}
+				err = e
+			} else {
+				err = e
+			}
+		}
+		log.Printf("db: waiting for database (attempt %d): %v", i+1, err)
+		time.Sleep(2 * time.Second)
+	}
+	if err != nil {
+		return nil, err
+	}
+	if err := gdb.AutoMigrate(models.All()...); err != nil {
+		return nil, err
+	}
+	return gdb, nil
+}