diff --git a/.codepress/dev-server/Dockerfile.web b/.codepress/dev-server/Dockerfile.web
new file mode 100644
index 0000000..79804ad
--- /dev/null
+++ b/.codepress/dev-server/Dockerfile.web
@@ -0,0 +1,73 @@
+# Generated by CodePress bootstrap-dev-server.
+# Dev-mode image for the "web" frontend (Live Dev Server).
+# Edits are preserved, but running /codepress-bootstrap-dev-server again may overwrite them.
+
+# Node 18 (not the current LTS) on purpose: this app is Create React App
+# `react-scripts@1.0.10` (webpack 2.6.1 / webpack-dev-server 2.5.0, React 15).
+# That 2017-era toolchain is not compatible with recent Node majors, and the
+# repo pins no version (`engines`/`.nvmrc` absent), so we hold at the oldest
+# Debian-bookworm Node image. This is the FULL bookworm image, not the trimmed
+# variant: the dependency install happens at run time inside this image and needs
+# the node-gyp toolchain (make/gcc/g++/python3) that the trimmed variant strips.
+FROM public.ecr.aws/docker/library/node:18-bookworm
+
+# System packages the dev runtime needs. `procps` only: nothing in web/yarn.lock
+# builds a native module from source on linux (the single native dependency,
+# fsevents@1.1.2, is darwin-only and skipped), so no extra apt library is needed.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends procps \
+    && rm -rf /var/lib/apt/lists/*
+
+# Package manager: Yarn 1 (Classic), matching web/yarn.lock. The repo declares
+# no `packageManager` field, and this base image already bundles Yarn 1.22, so we
+# deliberately do NOT `corepack enable` here — the corepack shim would replace
+# the bundled binary with one that downloads Yarn from the public registry on the
+# first command, adding a network dependency to every cold start. Bake a pinned
+# fallback only if the base image ever stops shipping Yarn.
+RUN command -v yarn >/dev/null 2>&1 || npm install -g yarn@1.22.22
+
+WORKDIR /app
+
+# THIN image: no `node_modules`, no source COPY. The dev-server runtime provides
+# dependencies at run time (squashfs hydration, or `yarn install --frozen-lockfile`
+# in this image against the bind-mounted checkout). Only the toolchain lives here.
+
+# HMR + bind config — values come from the runtime, never hardcoded.
+ENV HOSTNAME=0.0.0.0 \
+    CODEPRESS_BIND_HOST=0.0.0.0 \
+    PORT=3000 \
+    CODEPRESS_HMR_CLIENT_PORT=443 \
+    CODEPRESS_HMR_PROTOCOL=wss
+
+# CRA-specific dev-server settings, all consumed by react-scripts@1.0.10:
+#  * BROWSER=none            — react-dev-utils would otherwise try to launch a
+#                              browser inside the container on start.
+#  * DANGEROUSLY_DISABLE_HOST_CHECK — webpack-dev-server's DNS-rebinding host
+#                              check rejects the preview hostname. CRA already
+#                              disables it while `package.json` has no "proxy"
+#                              field; setting it explicitly keeps the preview
+#                              working if a proxy is added later.
+#  * NODE_OPTIONS            — legacy OpenSSL provider, so this vintage webpack's
+#                              hashing keeps working on OpenSSL 3.
+ENV BROWSER=none \
+    DANGEROUSLY_DISABLE_HOST_CHECK=true
+
+WORKDIR /app/web
+EXPOSE 3000
+
+# Put the workspace bins on PATH so the dev command — and anything it shells out
+# to — resolves node_modules/.bin even when a binary is invoked directly. These
+# dirs are populated at run time on the bind-mounted checkout (hydration /
+# runtime install). Prepend, never replace ${PATH}.
+ENV PATH="/app/web/node_modules/.bin:/app/node_modules/.bin:${PATH}"
+
+# Dev command (HMR on) — identical to `dev_command` in recipe.json, so the
+# container path and the direct MicroVM path behave the same.
+#  * HOST / PORT are what react-scripts@1.0.10 reads to bind (scripts/start.js),
+#    so bind lands on 0.0.0.0 via CODEPRESS_BIND_HOST, never on loopback only.
+#  * This CRA version's HMR client derives its websocket URL from
+#    window.location and connects to /sockjs-node, so it rides the public preview
+#    origin automatically. WDS_SOCKET_PORT is passed for the uniform runtime
+#    contract and for a future react-scripts upgrade that honors it.
+#  * Invoked through the package manager (`yarn start`), never a bare bin.
+CMD ["sh", "-c", "HOST=\"${CODEPRESS_BIND_HOST:-0.0.0.0}\" PORT=\"${PORT:-3000}\" BROWSER=none DANGEROUSLY_DISABLE_HOST_CHECK=true WDS_SOCKET_PORT=\"${CODEPRESS_HMR_CLIENT_PORT:-443}\" NODE_OPTIONS=\"${NODE_OPTIONS:-} --openssl-legacy-provider\" yarn start"]
diff --git a/.codepress/dev-server/recipe.json b/.codepress/dev-server/recipe.json
new file mode 100644
index 0000000..4e11541
--- /dev/null
+++ b/.codepress/dev-server/recipe.json
@@ -0,0 +1,22 @@
+{
+  "schema_version": 1,
+  "bootstrapped_at": "2026-07-25T20:05:57Z",
+  "discovery_branch": "codepress/dev@codepress.dev/bootstrap-live-dev-server-artifacts-26adf615",
+  "frontends": [
+    {
+      "label": "web",
+      "working_dir": "web",
+      "dockerfile_path": ".codepress/dev-server/Dockerfile.web",
+      "dev_command": "sh -c 'HOST=\"${CODEPRESS_BIND_HOST:-0.0.0.0}\" PORT=\"${PORT:-3000}\" BROWSER=none DANGEROUSLY_DISABLE_HOST_CHECK=true WDS_SOCKET_PORT=\"${CODEPRESS_HMR_CLIENT_PORT:-443}\" NODE_OPTIONS=\"${NODE_OPTIONS:-} --openssl-legacy-provider\" yarn start'",
+      "prebuild_command": "",
+      "prebuild_inputs": [],
+      "framework": "cra",
+      "package_manager": "yarn",
+      "install_command": "yarn install --frozen-lockfile",
+      "dependency_manifests": ["web/yarn.lock"],
+      "dev_port": 3000,
+      "system_packages": ["procps"],
+      "size": "medium"
+    }
+  ]
+}