diff --git a/.codepress/dev-server/Dockerfile.web b/.codepress/dev-server/Dockerfile.web
new file mode 100644
index 0000000..992e377
--- /dev/null
+++ b/.codepress/dev-server/Dockerfile.web
@@ -0,0 +1,56 @@
+# Generated by CodePress bootstrap-dev-server.
+# Dev-mode image for the "web" frontend (Live Dev Server).
+# Edits are preserved, but running /codepress-bootstrap-dev-server again may overwrite them.
+#
+# Node 16 is deliberate, not stale: web/ is Create React App 1.0.10, whose bundler
+# is webpack 2.6.1. webpack 2 hashes with MD4, which OpenSSL 3 (Node 17+) removed
+# from the default provider — on a current-LTS base the dev server dies immediately
+# with `error:0308010C:digital envelope routines::unsupported`. Node 16 ships
+# OpenSSL 1.1.1, so it runs this toolchain as-is with no legacy-provider flag.
+# If react-scripts is ever upgraded, bump this base to the current LTS.
+FROM public.ecr.aws/docker/library/node:16-bookworm
+
+# System packages the dev runtime needs. `procps` only: this app has no
+# source-built native modules (its single native dep, fsevents, is macOS-only and
+# skipped on linux), so no extra apt library is required.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends procps \
+    && rm -rf /var/lib/apt/lists/*
+
+# Bake the package manager (yarn classic — web/yarn.lock is a v1 lockfile) so a
+# cold start never has to fetch a package manager from the public registry. The
+# node base already ships yarn 1.x; install it only if that ever changes. This
+# bakes ONLY the yarn binary — no application dependencies.
+RUN (command -v yarn >/dev/null 2>&1 || npm install -g yarn@1.22.22) \
+    && yarn --version
+
+WORKDIR /app
+
+# THIN image: no `node_modules`, no source COPY. The dev-server runtime provides
+# dependencies at run time (squashfs hydration, or `yarn install` in this image
+# against the bind-mounted checkout). Only the toolchain lives here.
+
+# HMR + bind config — values come from the runtime, never hardcoded.
+ENV HOSTNAME=0.0.0.0 \
+    CODEPRESS_BIND_HOST=0.0.0.0 \
+    PORT=3000 \
+    CODEPRESS_HMR_CLIENT_PORT=443 \
+    CODEPRESS_HMR_PROTOCOL=wss \
+    BROWSER=none \
+    DANGEROUSLY_DISABLE_HOST_CHECK=true
+
+WORKDIR /app/web
+EXPOSE 3000
+
+# Put the workspace bins on PATH so the dev command — and anything it shells out
+# to — resolves node_modules/.bin even when a binary is invoked directly. These
+# dirs are populated at run time on the bind-mounted checkout. Prepend, never
+# replace ${PATH}.
+ENV PATH="/app/web/node_modules/.bin:/app/node_modules/.bin:${PATH}"
+
+# Dev command (HMR on). `react-scripts start` reads HOST/PORT from the env, so the
+# bind address comes from CODEPRESS_BIND_HOST rather than a hardcoded literal.
+# WDS_SOCKET_PORT is set for the uniform runtime contract; this vintage of
+# webpack-dev-server (2.5.0) derives its HMR socket URL from window.location,
+# which already resolves to the public preview origin behind the proxy.
+CMD ["sh", "-c", "HOST=\"${CODEPRESS_BIND_HOST:-0.0.0.0}\" PORT=\"${PORT:-3000}\" WDS_SOCKET_PORT=\"${CODEPRESS_HMR_CLIENT_PORT:-443}\" BROWSER=none yarn start"]
diff --git a/.codepress/dev-server/recipe.json b/.codepress/dev-server/recipe.json
new file mode 100644
index 0000000..ba8725b
--- /dev/null
+++ b/.codepress/dev-server/recipe.json
@@ -0,0 +1,22 @@
+{
+  "schema_version": 1,
+  "bootstrapped_at": "2026-07-25T10:29:50Z",
+  "discovery_branch": "master",
+  "frontends": [
+    {
+      "label": "web",
+      "working_dir": "web",
+      "dockerfile_path": ".codepress/dev-server/Dockerfile.web",
+      "dev_command": "sh -c 'HOST=\"${CODEPRESS_BIND_HOST:-0.0.0.0}\" PORT=\"${PORT:-3000}\" WDS_SOCKET_PORT=\"${CODEPRESS_HMR_CLIENT_PORT:-443}\" BROWSER=none yarn start'",
+      "prebuild_command": "",
+      "prebuild_inputs": [],
+      "framework": "cra",
+      "package_manager": "yarn",
+      "install_command": "yarn install --frozen-lockfile",
+      "dependency_manifests": ["web/yarn.lock"],
+      "dev_port": 3000,
+      "system_packages": ["procps"],
+      "size": "medium"
+    }
+  ]
+}