Everything included
The work that produces no product differentiation, finished before you start — so week one goes into the thing people actually pay for.
Scaffold the API, the admin panel and the frontend together — wired, typed and running before you have finished your coffee.
CSRF, a strict content policy, rate limiting and a tamper-evident audit log ship in the scaffold, not in a checklist for later.
Embed a SPA in the Go binary, split into a monorepo, go API-only, or add mobile and desktop. Same generators throughout.
Go models generate TypeScript types and validation schemas, so the two halves of your app cannot drift apart.
Everything lands in your repository as ordinary source. No runtime magic to fight, nothing hidden behind a dependency.
Auth, storage, email, queues and cron are already there — each a separate package you can switch off or delete.